Using an internal CA, can valid X.509 certificates be created for mDNS domain names (as distinct from conventional DNS domain names)? E.g. a hostname like radius.local?

Would such a certificate be valid for EAP-TLS authentication?

Obviously a public CA could never issue a certificate for such a name, but I want to know if they are usable for authenticating hosts in private networks.

RFC5216 for EAP-TLS specifies that:

A server identity will typically represent a host, not a user or a resource. As a result, a subjectAltName of type dnsName SHOULD be present in the server certificate. If a dnsName is not available other field types (for example, a subjectAltName of type ipAddress or uniformResourceIdentifier) MAY be used.

RFC3280 Section defines the subjectAltName and dnsName type thereof, but AFAIK it substantially predates the invention of mDNS, and it's not clear to me whether mDNS counts as DNS for validating such a certificate.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.