Obtaining an SSL certificate for a local web application

Question

I have a web application that communicates with Amazon's Alexa API and is hosted locally on a computer. The application must use https for the communication and is accessed by using the IP address. The problem is that whenever I access the application I get the "The connection is not private".

I've looked into getting a certificate from places like LetsEncrypt, but they require that a domain is present, which in my case I only have a local IP address.

Is there a way to obtain a certificate for this application so that there's no error? I wwill also have to distribute this application to clients, so the certificate must be either portable or easily renewable.

Answer 1

Is there a way to obtain a certificate for this application so that there's no error?

From a public CA you can only get certificates which are for public sites, i.e. neither internal domains nor internal IP addresses. And usually you don't get certificates for public IP addresses too.

I will also have to distribute this application to clients, so the certificate must be either portable or easily renewable.

What you are trying to do is a very bad idea since this means that all installations share the same certificate and private key. An attacker having access to one installation can thus impersonate and silently man in the middle other installations.

I have no idea of your exact use case. But some use cases of shipping a https enabled system to customers is to use self-signed certificates (each system gets a different one) where the user has to add an exception to the browser and/or the ability for the customer to upload its own certificates.

Answer 2

If you intend to only access your application through the server IP address, you will not be able to use a public CA. Well maybe you could but IMHO it does not really make sense.

You should use a sel-signed certificate for your server, or build a private CA. OpenSSL is enough for both, and you should be able to find tutorials or front ends anywhere.

An a bit dated frontend, but still provided on many BSD or Linux distribs and reasonably easy to use is TinyCA, with for example an english tuto here. xca is another more recent frontend with good reputation. The good part when using a private CA, is that your give your root cert (without the key of course!) to your clients, they install it in the sertificate store of their favourite browser, and all works fine. But you must declare the certificate validation chain in your server.

Anyway, a good reading is the excellent OpenSSL cookbook available for free from FeistyDuck