2

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is:

127.0.0.1:5559 uses an invalid security certificate.
The certificate is only valid for 127.0.0.1
Error code: SSL_ERROR_BAD_CERT_DOMAIN

However, 127.0.0.1 is in alternative DNS names. Here is my OpenSSL config file:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
CN = chacheserver.net
[v3_req]
keyUsage = digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1
Improve this question
2
  • 2
    I think that your error appears because your cert is signed to another domain.
    – Christos
    Commented May 1, 2016 at 19:49
  • That config file puts SAN in the CSR; are you sure you copied it to the cert? Does openssl x509 -noout -text -in certfile show the SAN values (assuming you have or get it in a file)?
    – dave_thompson_085
    Commented May 2, 2016 at 9:56

2 Answers 2

Reset to default
6

Try to mark your IPs with type IP. (instead of type DNS.).

Namely, make your section look like this:

[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1
IP.1 = 192.168.1.130
IP.2 = 192.168.1.70
IP.3 = 192.168.2.130
IP.4 = 192.168.2.70
IP.5 = 192.168.8.70
IP.6 = 192.168.8.130
IP.7 = 127.0.0.1

Some broken browsers (older Internet Explorers, I think) actually expect IPs to be marked "DNS". So for backwards compatibility you can leave the IPs marked as they are and ALSO add them marked with type ID "IP".

Further reading

Sidenote: Multiple wildcards will probably not work.

I don't think many clients will accept more than a single wildcard.

So they will probably accept these:

DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net

But reject these:

DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
Improve this answer
1
  • 1
    Ad "you can leave the IPs marked as they are": Beware that Firefox will consider these "DNS" records invalid and ignore rest of the SAN (see serverfault.com/a/1101182). If you must have these records, please make sure they are on the end.
    – user185953
    Commented Jan 31 at 9:35
4

You've added 127.0.0.1 to your alternative DNS for the certificate, but 127.0.0.1 is an IP address, not a domain name. The DNS field requires the use of a domain name, which means the client does a lookup on the domain name of the IP and gets localhost. Since this doesn't match ("127.0.0.1" != "localhost") you get the mismatch error.

The field you're looking for is subjectAltName. This allows you to set alternative common names (CNs) including IP addresses.

Improve this answer
2
  • there is already subjectAltName = @alt_names
    – Basel Sayeh
    Commented May 1, 2016 at 21:05
  • @BaselSayeh I'm not sure that works. Try explicitly providing them in the subjectAltName.
    – Polynomial
    Commented May 1, 2016 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .