1

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate?

We are still trusting the appropriate root CA, but relaxing the rules of the name just a bit.

2
  • CAs won't issue such certificates, apparently. But you can workaround with localhost.yourdomain.com.
    – gowenfawr
    Sep 21 at 0:15
  • @gowenfawr Figured, however this is for internal use. Sep 21 at 0:24
1

The purpose of certificate is to prove that the owner is who the one claims to be. For instance, random people cannot get certificate for www.microsoft.com or www.google.com. Only the owner of these web sites can get such certificates.

But every host can be referred as localhost. Thus, everyone could actually get certificate for localhost. Thus, if you establish connection to localhost and get any certificate issued by any trusted CA, you cannot know if this is your certificate for localhost or certificate of some other party. Thus, despite valid certificate, you would not know who you are talking to.

A consequence is a possibility of man in the middle attack. If somebody intercepts your traffic to localhost and uses another certificate for localhost, such interception cannot be detected, because everyone could get a valid certificate for localhost.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.