2

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is:

127.0.0.1:5559 uses an invalid security certificate.
The certificate is only valid for 127.0.0.1
Error code: SSL_ERROR_BAD_CERT_DOMAIN

However, 127.0.0.1 is in alternative DNS names. Here is my OpenSSL config file:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
CN = chacheserver.net
[v3_req]
keyUsage = digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1
  • 2
    I think that your error appears because your cert is signed to another domain. – Christos May 1 '16 at 19:49
  • That config file puts SAN in the CSR; are you sure you copied it to the cert? Does openssl x509 -noout -text -in certfile show the SAN values (assuming you have or get it in a file)? – dave_thompson_085 May 2 '16 at 9:56
5

Try to mark your IPs with type IP. (instead of type DNS.).

Namely, make your section look like this:

[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1
IP.1 = 192.168.1.130
IP.2 = 192.168.1.70
IP.3 = 192.168.2.130
IP.4 = 192.168.2.70
IP.5 = 192.168.8.70
IP.6 = 192.168.8.130
IP.7 = 127.0.0.1

Some broken browsers (older Internet Explorers, I think) actually expect IPs to be marked "DNS". So for backwards compatibility you can leave the IPs marked as they are and ALSO add them marked with type ID "IP".

Further reading

Sidenote: Multiple wildcards will probably not work.

I don't think many clients will accept more than a single wildcard.

So they will probably accept these:

DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net

But reject these:

DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
3

You've added 127.0.0.1 to your alternative DNS for the certificate, but 127.0.0.1 is an IP address, not a domain name. The DNS field requires the use of a domain name, which means the client does a lookup on the domain name of the IP and gets localhost. Since this doesn't match ("127.0.0.1" != "localhost") you get the mismatch error.

The field you're looking for is subjectAltName. This allows you to set alternative common names (CNs) including IP addresses.

  • there is already subjectAltName = @alt_names – Basel Sayeh May 1 '16 at 21:05
  • @BaselSayeh I'm not sure that works. Try explicitly providing them in the subjectAltName. – Polynomial May 1 '16 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.