I would like to install an SNI certificate
There's no such thing as an SNI certificate. That's a TLS extension, and it means the server name is sent in the ClientHello
.
certificate that supports both the hostnames nas.domain.local. in addition to home.notarealdomainname.com.
The CAs probably won't issue that certificate because of nas.domain.local
.
But its not clear to me where issuing it is prohibited under the CA/Browser (CA/B) Baseline Requirements documents (CA's and Browsers do what they agree upon in the CA/B Forums; they don't follow anything from the IETF or RFCs).
Because of home.notarealdomainname.com
, you will satisfy section 11.1.1, Authorization by Domain Name Registrant. Section 11.3 prohibits *.local
, but that's due to the wildcard (and not the local name).
Since I can't find where the CAs are prohibited from issuing the certificate, you should ask CAs about issuing a certificate that includes a local name (in addition to the public name you control).
I don't want to issue my own certificate as, for expediency in use, I would like browsers to trust the certificate.
You should perform the following steps (even though you don't quite want to do it):
- create your own CA
- create a CSR with all the names you want the server to have
- issue a cert based on the CSR
- sign the cert with your CA
- install your CA on your devices and machines
The only difference between the pre-trusted list of CAs in browsers and certificate stores and your CA is you have to install your CA manually.
If you need to use OpenSSL to create a CSR with multiple Subject Alt Names (like nas.domain.local
and home.notarealdomainname.com
), then see this question on Stack Overflow: Certificate with Extended Key Usage only works in Firefox. In particular, see the OpenSSL configuration file.
Finally, this is a known problem with the Internet of Things; and it currently lacks a solution. It was recently brought up on the Web App Security mailing list. See Proposal: Marking HTTP As Non-Secure:
I'd like to propose consideration of a fourth category: Personal
Devices (home routers, printers, IoT, raspberry pis in classrooms,
refrigerators):
- cannot, by nature, participate in DNS and CA systems
- likely on private network block
- user is the owner of the service, hence can trust self rather than CA