Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it at all possible to create a self-signed certificate for use on multiple machines on a local network which would stop the browser complaining it is not a trusted site?

We have a product which is basically a computer running lighttpd to serve a web interface for configuring the computer (sort of how a router has a web interface). There can also be many of these machines running on the same network with dynamic IP's. What I basically want to do is enable SSL for extra security but I don't want people who are on the local network to be given a browser warning about the certificate not being trusted.

Is this at all possible?

share|improve this question

migrated from stackoverflow.com Nov 12 '12 at 9:10

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer

Yep.

As long as you control the certificate caches on the local machines, this is easy.

First, create a CA Root.

Set the CA root certificate expiry to be like, 20 years. Export the CA root public certificate as a pem file, and install it onto the client PCs. It'll appear as a Trusted CA Certificate.

Then use that CA to sign the CSR for the servers you wish to SSL encrypt. Then install the certificate you've generated there into the webserver's SSL certificate store, and configure the server to use that certificate.

If it's worked correctly, you'll be able to browse to the website, see that it's https encrypted, but as it's a pre-stored root certificate, you won't get the ugly red warning boxes and bars.

share|improve this answer
    
Do make sure, however, to keep a very tight hold on the private key for that CA certificate you've just created. If it leaks, https becomes meaningless for all users whose browsers trust that CA cert, as it can certify an SSL key for any website. –  MadHatter Nov 12 '12 at 9:54
    
True, but that's another problem. –  Tom O'Connor Nov 12 '12 at 9:59
    
I completely agree, and I certainly didn't mean to detract from your answer (which I upvoted, because I think it's right). I merely felt that Firefly should go into this solution understanding fully the implications of what (s)he's doing. –  MadHatter Nov 12 '12 at 10:02
    
There's a thing about creating a root CA, putting it in a box and locking it, then using a secondary root CA for actually signing shit. –  Tom O'Connor Nov 12 '12 at 10:22
    
I followed the instructions on the link you provided but I can't get it to work correctly. I think the problem lies in the fact that when you sign a certificate you have to provide a static hostname/domain? With the way our product works there is no domain name and the machines on the network have dynamic IP's. So even if I import a certificate and then try loading the web page up locally by browsing to (127.0.0.1) it still shows the red warning page :/ –  Firefly Nov 13 '12 at 0:48
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.