1

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. For example: http://10.0.0.100/myapp.php or http://192.168.1.19/myapp.php

How can I secure the web application so that it uses a valid SSL certificate? Issuing an SSL certificate from mycompany.com will not help because the web application is accessed from an arbitrary LAN IP address.

Self-signed SSL Certificate

It is possible to use self-signed SSL certificate as a workaround. That is not a long term solution, and I want to avoid users seeing this

Invalid SSL certificate in Chrome

Improve this question
3
  • You, the developers, can only give guidance to your customer's administration staff to properly configure the certificates for their users. It might be through a self-signed CA which signed the server certificate. Would it be satisfactory?
    – techraf
    May 26, 2016 at 4:22
  • You need to create an internal CA
    – paj28
    May 26, 2016 at 8:11
  • 1
    You could have a script that administrators run on the system straight after install. It would generate a CA then sign a certificate for the web application using its assigned internet hostname or domain name. Then the administrator distributes the CA cert to workstations for installation as a trusted root.
    – SilverlightFox
    May 27, 2016 at 10:05

2 Answers 2

Reset to default
1

AFAIK setting the exception in each users browser is the only way to get rid of that message when using a self-signed certificate. But: If your company has a wildcard certificate you could define a sub domain, that is just accessible in local net.

If your company doesn't have the wildcard certificate, you could still create the sub-domain, acquire a free SSL certificate (there are some certificate authorities lately offering ssl certificates for free) for the desired sub-domain for internal use.

Improve this answer
1

Option 1: Create a internal CA (for each customer!), add that CA root to all clients (using ActiveDirectory, for example) and create a Certificate for that service with that CA.

Option 2: Create a Certificate for a subdomain of your Company domain for each customer. If you have supercoolapp, register supercoolapp.ninja. For customer A, get a certificate for customerA.supercoolapp.ninja. To get this certificate, you either need to be able to receive mail at [email protected] (or something similar), change the DNS of supercoolapp.ninja or host a small text/html file on a public webserver at supercoolapp.ninja. You can do all of this without problems!

If possible, you then add customerA.supercoolapp.ninja into the local DNS of your customer A so it resolves to 10.0.0.100. If you can't do that, you can add this to your public DNS server! This way, everyone on the internet looking for the IP of customerA.supercoolapp.ninja will also get the IP 10.0.0.100 but because that IP is private is not able to connect.

Improve this answer
1
  • 1
    If customer has (all?) Windows-with-AD -- a big if -- they likely have Microsoft Certificate Services also, which already is a locally trusted CA; if so just prepare a CSR for MCS to process and use the resulting cert. Or, accept a pkcs12 (key plus cert chain) already generated by Windows tools.
    – dave_thompson_085
    Aug 24, 2016 at 23:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .