Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a webapp that I intend to be only accessible through its ip and port. It will be accessed externally.

e.g. xxx.xxx.xxx.xxx:8888

I want to enable SSL on the website, is it possible without a domain name?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Having the common name be an IP instead of a DNS name is technically allowed, but I don't think I've ever seen it implemented. If you're making the cert yourself, it should work. If you're having one purchased from a third party, you might have a tough time.

Why wouldnt you just use a DNS name for the server instead? I wouldn't type any info into a site that was only an IP, SSL or not.

share|improve this answer
    
Sounds like he's concerned about the next incarnation of SOPA :-) and perhaps doing something that would be shut down. –  Richard West Feb 11 '12 at 17:33
add comment

Yes, and the name does not even have to match, provided your users accept the certificate.

share|improve this answer
    
Some modern browsers will not allow an end user to override a mismatched CN or SAN on a certificate. –  MDMarra Feb 11 '12 at 17:10
add comment

You might be interested in this answer on StackOverflow.

From RFC 2818 (Section 3.1) (HTTPS/HTTP over TLS):

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.

[...]

In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.

This means that, for an IP address to work, it needs to be in an Subject Alternative Name entry of type IP address. Unlike with host names, where SANs are preferred but it can fall back on the CN in the Subject DN, the SAN entry is not optional when using an IP address. (This being said, some browsers might be a bit flexible when it comes to implementing that rule.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.