I have created my own CA and imported its root certificate on my devices. I use a signed SSL certificate to provide myself with remote access to my NAS. When I access my NAS over the proper URL (e.g. mynas.example.com) I get a green lock in chrome, so I got that working for me.
The problem lies in my LAN: Currently, when I access my NAS via it's LAN IP address, I receive a security warning that the name does not math the one on the certificate.
I tried to put the NAS IP into the X509v3 "Subject Alternative Name" section, but to no avail. The content is like this:
It works perfectly using the dynDNS name, but not with the LAN IP. My best guess is, that this section is not really evaluated, since I type the IP and the DNS is not needed. What am I missing? How can I enable "green lock"-TLS within my LAN?
The section in the openssl.cnf file looks like this:
[alt_names] DNS.1 = mynas.example.com DNS.2 = 192.168.1.42 IP.1 = 192.168.1.42
And all is working perfectly over WAN and within my LAN :-) The IP.1 is neccessary for Chrome, but Opera (and I think IE as well) needs the IP as DNS entry.