I have a private app running as a webserver on a machine on an isolated wifi router using 192.168.1.*/, with no DNS capability & no upstream Internet; basically, only local wireless. The web server will have one of two IP addresses: 192.168.1.x or 192.168.1.y, where x & y are fixed values.

What is the incantation of OpenSSL to create a CSR with two IP addresses, such that a client connecting to the web server on one of the two IP addresses would consider the certificate valid? Is there any way to use subjectAltName= and/or nameConstraints=permitted;IP:192.168.1.???/

It seems like bits & pieces are there, but there are so many options & commands in OpenSSL, I can't tell if this possible.

  • Are the clients actually accessing the web server by IP address? Do they use URLs like https://192.168.1.x/...? – David Schwartz Nov 3 '15 at 19:21
  • Yes, by IP address only. – Matthew Adams Nov 4 '15 at 2:22

Creating a cert for 192.168.1.* should work. Keep in mind that there are lots of sites that use wildcard certs in the *.mydomain.com form, so I see no reason why this one shouldn't work.

Although you probably know, you'll have to import that self-signed certificate in your browser(s) (respectively ask your users to do so) in order to avoid them asking whether you want to open an insecure site each time you surf there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.