Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to find-out how important the "ID type" for a SSL certificate is. I'm trying to generate a cert from my firewall to upload to a CA, but having trouble deciding if I should choose an IP, a domain name, or email for the ID Type (subject information).

Any insight to choosing which one would help (particularly if there is a best practice for VPN SSL certificates).

share|improve this question
up vote 4 down vote accepted

Most likely you'll want to use a Domain Name as the subject - but it depends what exactly you're wanting to encrypt using this certificate.

The most common case is access to an SSL port from the internet, for something like SSL-based VPN or an encypting reverse proxy; for that, you'll want the use a Domain Name subject type, and for the data in the subject field you'll want to use the DNS name that clients will be using to access the server - for the VPN use case, that might be something like

Let us know what the certificate's going to be for, and we can be more specific.

share|improve this answer
Yes, this is for an SSL port on our firewall (SSL-based VPN). Sounds like if an "A" record for the firewall's public IP is forwarded to is added in DNS, then my certificate's subject should really be it? – mrtechalot Jun 6 '12 at 16:09
@mrtechalot Yes, that's correct. – Shane Madden Jun 6 '12 at 16:16
Thank you. If you upvote me, I can have upvote rights and give you some extra points. update: scratch that, already have enough to upvote. – mrtechalot Jun 6 '12 at 16:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.