Got a query about self-signed certificates that after doing several searches I don't feel I've got a concrete answer for.
Say I have generated a self-signed server certificate with
CN=localhost. Does this mean that I can use that certificate in a server and be able to run that server on any machine in a LAN, where any client on the network with the certificate public key can communicate with the server (i.e. the server listens to any IP)?
As an example, I used the following script to generate certificates for use in a mutual TLS scenario (based on this answer):
echo Generate CA key: openssl genrsa -passout pass:1111 -aes256 -out ca.key 4096 echo Generate CA certificate: openssl req -passin pass:1111 -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/C=UK/ST=UK/L=London/O=YourCompany/OU=YourApp/CN=MyRootCA" echo Generate server key: openssl genrsa -passout pass:1111 -aes256 -out server.key 4096 echo Generate server signing request: openssl req -passin pass:1111 -new -key server.key -out server.csr -subj "/C=UK/ST=UK/L=London/O=YourCompany/OU=YourApp/CN=localhost" echo Self-sign server certificate: openssl x509 -req -passin pass:1111 -days 36500 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt echo Remove passphrase from server key: openssl rsa -passin pass:1111 -in server.key -out server.key echo Generate client key openssl genrsa -passout pass:1111 -aes256 -out client.key 4096 echo Generate client signing request: openssl req -passin pass:1111 -new -key client.key -out client.csr -subj "/C=UK/ST=UK/L=London/O=YourCompany/OU=YourApp/CN=localhost" echo Self-sign client certificate: openssl x509 -passin pass:1111 -req -days 36500 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt echo Remove passphrase from client key: openssl rsa -passin pass:1111 -in client.key -out client.key
What I am finding is that the server loads fine on some machines, however on other machines it fails to start, reporting that it could not bind to the port. I have checked that the port is definitely not being used by anything. Also the server starts fine if I don't use any certificates.
Am I doing something specifically wrong in the script, or is it not possible to have a certificate with
CN=localhost in a server that should be able to wrong on any machine in a local network, and accept connections from any client on the network that trusts the public key?