2

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is:

127.0.0.1:5559 uses an invalid security certificate.
The certificate is only valid for 127.0.0.1
Error code: SSL_ERROR_BAD_CERT_DOMAIN

However, 127.0.0.1 is in alternative DNS names. Here is my OpenSSL config file:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
CN = chacheserver.net
[v3_req]
keyUsage = digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1
2
  • 2
    I think that your error appears because your cert is signed to another domain.
    – Christos
    May 1, 2016 at 19:49
  • That config file puts SAN in the CSR; are you sure you copied it to the cert? Does openssl x509 -noout -text -in certfile show the SAN values (assuming you have or get it in a file)? May 2, 2016 at 9:56

2 Answers 2

5

Try to mark your IPs with type IP. (instead of type DNS.).

Namely, make your section look like this:

[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1
IP.1 = 192.168.1.130
IP.2 = 192.168.1.70
IP.3 = 192.168.2.130
IP.4 = 192.168.2.70
IP.5 = 192.168.8.70
IP.6 = 192.168.8.130
IP.7 = 127.0.0.1

Some broken browsers (older Internet Explorers, I think) actually expect IPs to be marked "DNS". So for backwards compatibility you can leave the IPs marked as they are and ALSO add them marked with type ID "IP".

Further reading

Sidenote: Multiple wildcards will probably not work.

I don't think many clients will accept more than a single wildcard.

So they will probably accept these:

DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net

But reject these:

DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
0
3

You've added 127.0.0.1 to your alternative DNS for the certificate, but 127.0.0.1 is an IP address, not a domain name. The DNS field requires the use of a domain name, which means the client does a lookup on the domain name of the IP and gets localhost. Since this doesn't match ("127.0.0.1" != "localhost") you get the mismatch error.

The field you're looking for is subjectAltName. This allows you to set alternative common names (CNs) including IP addresses.

2
  • there is already subjectAltName = @alt_names May 1, 2016 at 21:05
  • @BaselSayeh I'm not sure that works. Try explicitly providing them in the subjectAltName.
    – Polynomial
    May 1, 2016 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.