confusion with ssl cert and apache

Question

I created a self signed signature. I visited my site and saw that it was untrusted (in FF and IE). After accepting it i saw a msg in IE saying it was signed for a different domain. Come to think of it i dont remember ever writing the domain(s) i'll be using this certificate.

I am pretty sure i seen this error elsewhere. How do i self sign a certificate properly?

Answer 1

If the CN (Common Name) you use when you create the certificate is different from the name for your website, you will receive errors about it being signed for a different domain.

So, if your site is called

myselfsignedsite.whatever.com

Enter that when asked for the CN during the certificate creation process. That should remove the errors about domain.

It will still complain about it being untrusted though, unless you have it signed by a trusted CA.

Answer 2

The hostname of the URL must match the Common Name ("CN") of the Subject of the certificate. When you generate the Certificate Signing Request (CSR), OpenSSL prompts you for the country code, state or province, locality, organization, organizational unit, Common Name, and email address. Be sure to enter the hostname of your server as the Common Name. The CN can also be a wildcard (*.example.net).

It is also possible to generate a certificate that is valid for multiple discrete hostnames (not a wildcard), in which case the hostname can also match one of the subjectAltNames of the certificate. There are are two ways to create such a certificate with OpenSSL.

The easy way is for the Certificate Authority to put it into the signed certificate. The CA's openssl.cnf needs

[ usr_cert ]
subjectAltName=DNS:host1.example.com,DNS:host2.example.org

The other way is to put the subjectAltName in the CSR and have the CA honor it. In the requestor's openssl.cnf:

[ v3_req ]
subjectAltName=DNS:host1.example.com,DNS:host2.example.org

In the CA's openssl.cnf:

[ usr_cert ]
subjectAltName=email:copy

Either way, the generated certificate should be valid for three hostnames (host1.example.com, host2.example.org, and the CN of the subject).