I am creating a webapp that I intend to be only accessible through its ip and port. It will be accessed externally.
e.g. xxx.xxx.xxx.xxx:8888
I want to enable SSL on the website, is it possible without a domain name?
Add a comment
|
3 Answers
Having the common name be an IP instead of a DNS name is technically allowed, but I don't think I've ever seen it implemented. If you're making the cert yourself, it should work. If you're having one purchased from a third party, you might have a tough time.
Why wouldnt you just use a DNS name for the server instead? I wouldn't type any info into a site that was only an IP, SSL or not.
-
Sounds like he's concerned about the next incarnation of SOPA :-) and perhaps doing something that would be shut down. Feb 11, 2012 at 17:33
Yes, and the name does not even have to match, provided your users accept the certificate.
-
Some modern browsers will not allow an end user to override a mismatched CN or SAN on a certificate.– MDMarraFeb 11, 2012 at 17:10
You might be interested in this answer on StackOverflow.
From RFC 2818 (Section 3.1) (HTTPS/HTTP over TLS):
If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.
[...]
In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.
This means that, for an IP address to work, it needs to be in an Subject Alternative Name entry of type IP address. Unlike with host names, where SANs are preferred but it can fall back on the CN in the Subject DN, the SAN entry is not optional when using an IP address. (This being said, some browsers might be a bit flexible when it comes to implementing that rule.)
