Is it possible to use single self-signed certificate for all local domains, like: blog1.test, shop1.test, shop2.test, so i don't have to add all of these certificates to my Keychain (MacOS), instead i'd like to add just one generic self signed certificate?

Here's my /etc/ssl/openssl.cnf config:

[ san ]
subjectAltName                  = @alt_names

[ alt_names ]
DNS.1                           = localhost
DNS.2                           = domain.test

I generated my self-signed cert this way:

sudo openssl req -extensions san -config /etc/ssl/openssl.cnf -x509 -nodes -newkey rsa:4096 -keyout /private/etc/apache2/server.key -out /private/etc/apache2/server.crt -days 3650 -subj "/C=KZ/ST=Almaty/L=Almaty/O=Companyname/CN=localhost"

But even if i add to SAN more DNS records, it won't work on different domain than "localhost". Is this even possible?

  • I don’t see why that wouldn’t work. However, using wildcards may be easier. Do not that you should be using arbitrary TLDs in your local network. – Daniel B Mar 18 '18 at 15:08
  • Why it would work? I think Common Name is very important during certificate creation, not? – Alexander Kim Mar 18 '18 at 15:10
  • @DanielB, just tested again, it's indeed working. I just have to edit openssl.cnf everytime i want to add more domains, then recreate certificate and re add to my keychain. – Alexander Kim Mar 18 '18 at 18:10
  • 1
    It'd be a bit more work for initial setup, but in the long run it'd probably be easier in the long run to create your own CA root, mark that as trusted, then sign individual SSL certs with that. – Gordon Davisson Mar 18 '18 at 20:44
  • 1
    You build a CA and install that CA's certificate in your keychain as a trust-anchor. Every certificate issued by that CA is then automatically trusted by your browser/computer. Each time you stand up a new service (e.g. blog1.test or shop1.test) you have the CA issue a certificate to that service. That service's certificate will be trusted as the CA's certificate is already in your keystore and trusted. Maybe you need to Google 'Certification Authority' - it's a complex subject if you are doing it right (for production), but for a test environment it's quite simple to do. – garethTheRed Mar 19 '18 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.