3

I have created my own CA and imported its root certificate on my devices. I use a signed SSL certificate to provide myself with remote access to my NAS. When I access my NAS over the proper URL (e.g. mynas.example.com) I get a green lock in chrome, so I got that working for me.

The problem lies in my LAN: Currently, when I access my NAS via it's LAN IP address, I receive a security warning that the name does not math the one on the certificate.

I tried to put the NAS IP into the X509v3 "Subject Alternative Name" section, but to no avail. The content is like this:

DNS:mynas.example.com, DNS:192.168.1.42

It works perfectly using the dynDNS name, but not with the LAN IP. My best guess is, that this section is not really evaluated, since I type the IP and the DNS is not needed. What am I missing? How can I enable "green lock"-TLS within my LAN?


The section in the openssl.cnf file looks like this:

[alt_names]
DNS.1 = mynas.example.com
DNS.2 = 192.168.1.42
IP.1 = 192.168.1.42

And all is working perfectly over WAN and within my LAN :-) The IP.1 is neccessary for Chrome, but Opera (and I think IE as well) needs the IP as DNS entry.

  • 3
    Use the DNS name internally as well. Public CAs won't issue certificates valid for RFC1918 addresses in either the Subject Name or Subject Alternative Name fields and you should consider following their lead. – MDMarra Feb 6 '14 at 0:52
  • If the DNS name resolves to a non-local IP address, you can edit the local hosts file on the accessing hosts, or rely on an internal DNS server and create an A record. – mbrownnyc Feb 6 '14 at 15:55
4

192.168.1.42 is not an DNS name, but an IP address, e.g. you have to specify IP:192.168.1.42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.