3

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to HTTPS to make it more secure. But since the IP address of the device changes from time to time due to DHCP, I'm not sure how to provide the certificate.

The best solution I've had so far is to generate a self signed certificate every time the device boots up and add security exceptions to my browser which doesn't seem like the best approach to me.

Apart from making it Static IP, is there any other solution I can use?

  • I think certificates are more suited for domains, rather than IP Addresses, for exactly this reason. – Zymus May 23 '16 at 18:21
3

Why not register the certificate for a fully-qualified domain name, instead of for the IP address? Assuming you're running it as a server, and leave it running for good stretches of time, you'd visit the DNS provider, and change the mapping between IP address and domain name, only when you received a new IP address.

Additionally you could request a static DHCP lease for the MAC address corresponding to your NIC. Then each time you rebooted, the DHCP server would provide you with the same IP address.

  • 1
    Thanks for your answer. I was hoping to do it in a way that doesn't need a Static IP. I can work with the certificate for a domain name rather than an IP, but how would I keep track of the domain - IP mapping with IP addresses changing? – Rohit May 23 '16 at 18:36
  • @Rohit, you could certainly use a Dynamic DNS service to keep track of the changing IP address. Here's a blog entry on doing that. – Forest Monsen May 23 '16 at 18:39
  • Thanks, I think this would work great for my case. Is there a way to scale this to multiple Raspberry Pis on the same network? For example, If I get a certificate for domain my-pi.org, and host multiple devices as d1.my-pi.org, d2.my-pi.org etc., (I don't know if this is possible), would all of them be able to use the same certificate and update their IP address with the dynamic DNS service? – Rohit May 23 '16 at 18:56
  • Alternatively, since this sounds like a local network, you could use something like dnsmasq for DNS/DHCP that automatically does DNS based on hostname. – multithr3at3d May 23 '16 at 20:02
  • @Rohit, yes, you're looking to get a "wildcard" DNS certificate, which uses an asterisk, such as *.domain.com, to cover any number of subdomains (d1, d2, etc.). You can get one from your favorite domain name registrar. You'd then have each device handle its own dynamic DNS. – Forest Monsen May 23 '16 at 22:46
1

The most logical solution is to place the name in the subject of the certificate, and use dynamic DNS to make the name point to the same raspberry PI. Of course, one would need a DNS server.

If you can use IPv6 and having a DNS server is too much work, with it the Rasbperry would have a fixed address automatically with stateless autoconfiguration (based on the MAC), and you could have an entry in your /etc/hosts file (Linux) or C:\windows\system32\drivers\etc\hosts (Windows) that associates the name with the IPv6 link level address.

Perhaps there are other solutions, but anyway I would prefer a certificate based on a name rather than IP address.

  • Thanks for your answer. It's similar to the Forest's answer, but I do like the idea of using IPv6. Is there a way to do this, without having to make any changes to the hosts files in my PC? I'm aiming to automate things enough so that I can have multiple raspberry pis on the network accessible to multiple hosts. – Rohit May 23 '16 at 18:46
  • What is the problem with a one time change in the hosts file? – Ramón García May 23 '16 at 18:58
  • I could live with that if there's no other way, but if I can figure out the kinks, I would like to make this project available for other people to use and just wanted to keep things simple. – Rohit May 23 '16 at 19:04
  • Well, I guess one can generate a certificate with the IPv6 address in the subject. – Ramón García May 23 '16 at 19:05
  • No-iP is a free service that can point a domain name to Your dynamics address. I've tried it before and it's quiet simple and most routers come with the option to integrate this service. – Mero55 May 23 '16 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.