0

I have 2 Apache servers (with PHP):

  • public server A which hosts web pages, it has domain name etc.
  • public server B which hosts some services (built as PHP application) and those services are used only by server A (e.g. A in its PHP application uses curl function calls to server B PHP application). That is - B has open ports only for some specified servers, including A. There is no domain name assigned to B, B is reached by other applications (e.g. server A application) only by use of B's IP address. It is intention that B "keeps low profile" in the Internet.

My intention was to generate for B a self-signed SSL sertificate to encrypt any communication between A and B (communication can involve some private data).

But there are 2 problems:

  1. SSL certificate contains common name (domain name) but server B has not any. Can IP address be used as common name? Will certificate work?
  2. Currently I don't clearly understand what component of Apache infrastructure on server A will make use of server-B certificate and accordingly will encrypt and decrypt exchanged messages. It is clear that browser does this, but there are only two Apache servers each having its PHP application in my case.

I know that there are better ways to administer such task - put server A un B in (virtual) private newtork and prevent direct communication with B from outside world (but that is not possible due to organizational reasons in my case). But maybe my intended configuration can work as well?

Improve this question

1 Answer 1

Reset to default
1

Many applications happily use SSL/TLS encryption without checking the common name in the certificate. Too many won't even generate a warning about the CN mismatch.

Simply generate the self signed certificate and if an ip-address is not valid input use the hostname and test...

And of course using IPSEC would be a valid solution instead.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .