13

I have my application hosted in the cloud and while demoing to prospective clients, I would like to make sure that my browser doesn't complain due to the lack of trust. So I want to generate a self signed certificate that is bound to a IP address.

All of the online resources that I have read only talk about generating the certificate bound to the domain.

8
  • Your browser will still complain due to a lack of trust with any self-signed certificate. "self signed" mean's that the certificate was not signed by any trusted Certificate Authority, and the browser will not trust it by default. Jan 16, 2015 at 5:48
  • I have realized that SSL certificate for a public IP address is not that a good idea from the answers to the question mentioned by @MadHatter. I have decided to use SSL cert bound to a domain name and use the hosts file for the resolution for the testing and demo purposes. I have generated a self signed certificate using the command => keytool -genkey -keyalg RSA -alias selfsigned -keystore demo1keystore.jks -storepass ywkeystore@789 -validity 360 -keysize 2048 To add to the trust store read by chrome => blog.avirtualhome.com/…
    – acthota
    Jan 16, 2015 at 12:33
  • I have experimented with I.P as the CN for understanding how it works but ran into a few issues. Will post the findings shortly.
    – acthota
    Jan 16, 2015 at 12:38
  • 3
    I don't understand why someone down votes a question without citing the reason for the down vote. There should be a purpose for down voting..! So that the OP can edit the question OR ask better questions in the future. "Can the real down voter ... Please stand up.. Please stand up...! Server Fault.."
    – acthota
    Jan 17, 2015 at 3:21
  • 1
    I landed on this page with the same question in mind. And upvoting for the question... Jun 8, 2018 at 14:28

2 Answers 2

7

It doesn't matter if your subject is a name or an IP, the way you need to fix the cert being untrusted is the same: trust the self-signed cert on the local system.

If for some reason you need to use an IP instead of a name (hosts file?), then set up a subject alternative name with the IP address, like IP:192.0.2.1.

3

[Reposting my comment as the answer]

I have realized that SSL certificate for a public IP address is not that a good idea from the answers to the related question (linked to this question) by @MadHatter.

I have decided to use SSL cert bound to a domain name and use the hosts file for the dns resolution for the testing and demo purposes.

I have generated a self signed certificate using the command =>

keytool -genkey -keyalg RSA -alias selfsigned -keystore demo1keystore.jks -storepass mykeystore@789 -validity 360 -keysize 2048

To add to the trust store read by chrome => I have followed the instructions from this link

I have tested all this to understand what works in practice.

Tried with a

  • Self signed certified bound to a domain name and tested SSL connectivity with Chrome and Firefox and a Jetty Server. Things worked fine.
  • Self signed certified bound to a IP ADDRESS and tested SSL connectivity with Chrome and Firefox and a Jetty Server. The Chrome Browser failed to trust the certificate.

If anyone else has a different perspective about this, please reply as a comment. Accepting this as answer.

1

Not the answer you're looking for? Browse other questions tagged .