3

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to HTTPS to make it more secure. But since the IP address of the device changes from time to time due to DHCP, I'm not sure how to provide the certificate.

The best solution I've had so far is to generate a self signed certificate every time the device boots up and add security exceptions to my browser which doesn't seem like the best approach to me.

Apart from making it Static IP, is there any other solution I can use?

1
  • I think certificates are more suited for domains, rather than IP Addresses, for exactly this reason.
    – user64273
    May 23, 2016 at 18:21

2 Answers 2

3

Why not register the certificate for a fully-qualified domain name, instead of for the IP address? Assuming you're running it as a server, and leave it running for good stretches of time, you'd visit the DNS provider, and change the mapping between IP address and domain name, only when you received a new IP address.

Additionally you could request a static DHCP lease for the MAC address corresponding to your NIC. Then each time you rebooted, the DHCP server would provide you with the same IP address.

5
  • 1
    Thanks for your answer. I was hoping to do it in a way that doesn't need a Static IP. I can work with the certificate for a domain name rather than an IP, but how would I keep track of the domain - IP mapping with IP addresses changing?
    – Rohit
    May 23, 2016 at 18:36
  • @Rohit, you could certainly use a Dynamic DNS service to keep track of the changing IP address. Here's a blog entry on doing that. May 23, 2016 at 18:39
  • Thanks, I think this would work great for my case. Is there a way to scale this to multiple Raspberry Pis on the same network? For example, If I get a certificate for domain my-pi.org, and host multiple devices as d1.my-pi.org, d2.my-pi.org etc., (I don't know if this is possible), would all of them be able to use the same certificate and update their IP address with the dynamic DNS service?
    – Rohit
    May 23, 2016 at 18:56
  • Alternatively, since this sounds like a local network, you could use something like dnsmasq for DNS/DHCP that automatically does DNS based on hostname. May 23, 2016 at 20:02
  • @Rohit, yes, you're looking to get a "wildcard" DNS certificate, which uses an asterisk, such as *.domain.com, to cover any number of subdomains (d1, d2, etc.). You can get one from your favorite domain name registrar. You'd then have each device handle its own dynamic DNS. May 23, 2016 at 22:46
1

The most logical solution is to place the name in the subject of the certificate, and use dynamic DNS to make the name point to the same raspberry PI. Of course, one would need a DNS server.

If you can use IPv6 and having a DNS server is too much work, with it the Rasbperry would have a fixed address automatically with stateless autoconfiguration (based on the MAC), and you could have an entry in your /etc/hosts file (Linux) or C:\windows\system32\drivers\etc\hosts (Windows) that associates the name with the IPv6 link level address.

Perhaps there are other solutions, but anyway I would prefer a certificate based on a name rather than IP address.

5
  • Thanks for your answer. It's similar to the Forest's answer, but I do like the idea of using IPv6. Is there a way to do this, without having to make any changes to the hosts files in my PC? I'm aiming to automate things enough so that I can have multiple raspberry pis on the network accessible to multiple hosts.
    – Rohit
    May 23, 2016 at 18:46
  • What is the problem with a one time change in the hosts file? May 23, 2016 at 18:58
  • I could live with that if there's no other way, but if I can figure out the kinks, I would like to make this project available for other people to use and just wanted to keep things simple.
    – Rohit
    May 23, 2016 at 19:04
  • Well, I guess one can generate a certificate with the IPv6 address in the subject. May 23, 2016 at 19:05
  • No-iP is a free service that can point a domain name to Your dynamics address. I've tried it before and it's quiet simple and most routers come with the option to integrate this service.
    – Mero55
    May 23, 2016 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .