For the past couple of hours I've been trying to create a self-signed certificate which I'd like to use to encrypt HTTP traffic between computers and a server on my home network (because I'm paranoid like that). However, I'm not sure if I'm doing this right because I keep getting security warnings in my web browsers. Especially Google Chrome does not like what I'm doing.

Hopefully someone more experienced can provide guidance.

My server (a Synology DiskStation) can be reached both internally (via its local IP address or hostname), or through the internet (via a public IP address or DNS name). Unfortunately, the public IP address is dynamic. However, a service running on my server updates the DNS entry every 60 minutes.

What I've done is I've used OpenSSL to generate a self-signed X.509 certificate (using default settings for the biggest part). I did not specify a CN (Common Name), because during earlier testing I found that it would cause even more security warnings when accessing the server internally. Instead, I included the DNS name, hostname and local IP address in the subjectAltName extension field.

My server's certificate now looks like this: https://dl.dropbox.com/u/14454764/cert.crt

I then proceeded to install this certificate in the Trusted Root Certification Authorities certificate store on my windows machine. I can now access the webserver using HTTPS, but not without warning.

Errors include:

• (Google Chrome) Server's certificate does not match the URL. (when using hostname)
• (Google Chrome) The identity of this website has not been verified. (when using local IP)
• (Internet Explorer) The security certificate presented by this website was issued for a different website's address. (when using local IP)

These warnings return whenever I restart the browser. If I access the webserver from the internet (using the DNS name), none of my browsers complain and everything is fine.

Can I generate certificates for internal use which do not trigger such errors? I'd greatly appreciate your help.