0

I have an embedded device and it is running a https server. This device will be accessed from a standard web browser using the IP address. I am generating a TLS certificate. I have added a commonName (static string) and subjectAltName (default IP address) and generated the certificate.

If the IP address is changed or DHCP is enabled or more interfaces are added, like the device can also have a private IP 192.168.x.x or 169.254.x.x, do I have to regenerate the certificate?

What is the general recommendation for certificates using an IP address and having a dynamic or more than one IP?

2

It's generally not recommended to use IP addresses for certificates.

That said, you have several alternatives. If you absolutely must use an IP address as identifier, then you can configure your DHCP server to always give the NIC of the embedded device the same IP address. I use this technique to ensure all static devices in my home have fixed, known IP addresses (e.g. my router is 192.168.0.1, my home server is 192.168.0.2, etc.), and all "dynamic" devices (e.g. phones, etc.) have high IP addresses.

An addition to this is to use DNS. You can use an internal DNS server, which manages a pseudo-TLD such as .lan or .local, and use that to give your devices logical names. For example, you can designate your printer as printer.lan, and give it the fixed IP address 192.168.0.7. This way, you don't need to re-generate the certificate if the IP should ever change. You just need to change the DNS entry.

But why is it not recommended to use IP addresses for certificates?

This is a legitimate question. It makes conceptual sense to certify that something is reachable under a certain name, rather than a certain address. The CA wants to sign "This certificate is for printer.lan", not "This certificate is for 192.168.0.7", because as you correctly identified, you really can't know who 192.168.0.7 will be in a month or two.

Logical names, on the other hand, will stay the same. Your phone will never be called printer.lan, even if it may one day be reachable under 192.168.0.7.

| improve this answer | |
  • So, how can we implement TLS on local IoT devices using a general design pattern? Must we have custom DHCP rules like this, or is there a higher-level approach one can take. Self-signed? – schroeder Dec 11 '19 at 11:02
  • There are several approaches, and it depends on your infrastructure, the number of clients, the number of certificates, etc.... You may get away with a self-signed certificate trusted manually on each client. You may need a CA, which manages all your devices. – MechMK1 Dec 11 '19 at 11:06
  • Thanks for your detailed answer. Can you check certificate of this cloudflare service 1.1.1.1 , certificate has a CN and it has put all possible IPv4 and Ipv6 address in subject alternative name. Can I use this approach. What if I have no DNS and want to use static IP? – Chits Dec 11 '19 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.