For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) before clients can post some data.

There is much less information about client certificates. Besides documentations, there are best practices. I would like to know, how to set common name and subject alternative names for clients, as they won't have a domain name and a fix IP address.

Do I simply tell the server to ignore a mismatch? Can I use a wild card only CN (CN=*)? I also would like the cert to identify specific client. Server needs to be able to tell apart client 1 from client 2, etc...

Thanks!

up vote 1 down vote accepted

What is used as subject in the client certificate depends on the context. If humans should be identified commonly an email address or a name is used. If machines should be identified typically the hostname of the machine is used. In the latter case it is probably best to use a subject alternative name (and maybe CN too) since a CN by itself does not express the type of the subject (i.e. DNS name, IP address, URL...).

  • So, I can put "Client 1" as CN and subject alt name and server would accept it? I will need Apache to authenticate my clients. – Genom Sep 3 at 20:25
  • @Genom: you can make the server accept it, check SSLRequire for how to restrict what the server accepts. – Steffen Ullrich Sep 3 at 21:06
  • Thanks. This answer my questions (CN and subject alt names can be anything, which can get accepted by the server). – Genom Sep 3 at 21:11
  • In standard HTTPS setups nowadays, the CN is put aside and only the SANs count. – Patrick Mevzek Sep 3 at 23:14
  • 1
    @PatrickMevzek: that's standard for client validating server, but there is no such standard for server validating client which is the Q here – dave_thompson_085 Sep 4 at 4:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.