0

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. For example: http://10.0.0.100/myapp.php or http://192.168.1.19/myapp.php

How can I secure the web application so that it uses a valid SSL certificate? Issuing an SSL certificate from mycompany.com will not help because the web application is accessed from an arbitrary LAN IP address.

Self-signed SSL Certificate

It is possible to use self-signed SSL certificate as a workaround. That is not a long term solution, and I want to avoid users seeing this

Invalid SSL certificate in Chrome

  • You, the developers, can only give guidance to your customer's administration staff to properly configure the certificates for their users. It might be through a self-signed CA which signed the server certificate. Would it be satisfactory? – techraf May 26 '16 at 4:22
  • You need to create an internal CA – paj28 May 26 '16 at 8:11
  • 1
    You could have a script that administrators run on the system straight after install. It would generate a CA then sign a certificate for the web application using its assigned internet hostname or domain name. Then the administrator distributes the CA cert to workstations for installation as a trusted root. – SilverlightFox May 27 '16 at 10:05
1

AFAIK setting the exception in each users browser is the only way to get rid of that message when using a self-signed certificate. But: If your company has a wildcard certificate you could define a sub domain, that is just accessible in local net.

If your company doesn't have the wildcard certificate, you could still create the sub-domain, acquire a free SSL certificate (there are some certificate authorities lately offering ssl certificates for free) for the desired sub-domain for internal use.

1

Option 1: Create a internal CA (for each customer!), add that CA root to all clients (using ActiveDirectory, for example) and create a Certificate for that service with that CA.

Option 2: Create a Certificate for a subdomain of your Company domain for each customer. If you have supercoolapp, register supercoolapp.ninja. For customer A, get a certificate for customerA.supercoolapp.ninja. To get this certificate, you either need to be able to receive mail at admin@supercoolapp.ninja (or something similar), change the DNS of supercoolapp.ninja or host a small text/html file on a public webserver at supercoolapp.ninja. You can do all of this without problems!

If possible, you then add customerA.supercoolapp.ninja into the local DNS of your customer A so it resolves to 10.0.0.100. If you can't do that, you can add this to your public DNS server! This way, everyone on the internet looking for the IP of customerA.supercoolapp.ninja will also get the IP 10.0.0.100 but because that IP is private is not able to connect.

  • 1
    If customer has (all?) Windows-with-AD -- a big if -- they likely have Microsoft Certificate Services also, which already is a locally trusted CA; if so just prepare a CSR for MCS to process and use the resulting cert. Or, accept a pkcs12 (key plus cert chain) already generated by Windows tools. – dave_thompson_085 Aug 24 '16 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.