New answers tagged


Yes, you can. You just need to have the private key in the proper format to be used by openssl. Not knowing in which format you exported, it's impossible to provide commands, but -supposing it can't sign directly with it- openssl x509 may be able to convert the file.


Changes to DNS aliases (CNAME) or IP addresses do not matter at all to certificate validation. All what matters is that the hostname as seen by the client (for example the name in the URL) matches the subject(s) of the certificate. This name will not change on any changes to the DNS. Often a DNS CNAME gets confused with a HTTP redirect. In the case of CNAME ...


Rouge Key Identifiers would hinder unambiguous path finding. In the worst case several potential paths have to be checked for validity. But would you have a certificate with a rouge identifier in your trust store anyway? If you don’t trust it, no need to check that path. And if you do trust it, then that path would not validate.


The security is security, no matter the network zone. Yes, there are not so much potential attacckers for LAN-only server, but it's not just leveraged, but hightened by the network speed : one lan attacker on strong/stable/guaranteed 1Gbps speed can try as many passwords, as 100 attackers from the WAN/WWW/Web with unstable connection speed, for example. Use ...


Looking at google certificate’s, it’s now very clear… The answer is yes of course since you can request to be a certificate authority for the domains you control…


As to the first part of your question. the answer is NO, and all who say it is forget that that also means breaking essential layers of security on the device. as to the second it is possible but highly dubious to do so. The way to do this is by buying a certificate for a domain (like and have its DNS entry point to and ...

Top 50 recent answers are included