1

I created an x509 certificate using gnu certtool, in the certificate template i specified cn=myip Problem is that each time I change my network I need to remake the certificate because my ip changes...and from client side it is even worst:if I want to contact a server on my private network I need a 192.168 address, while on a public network I need to specify a true address...this is annoying...

Edit. I need this for tls procol and mutual authentication.

2 Answers 2

1

RFC 2818 says the following:

In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.

You should probably be using a resolvable (public or private) domain name for the CN field. It is not advisable to use an IP address for CN as the RFC recommends using the SAN field.

0

The best thing you can use here is to specify a domain better than an IP so you can easily move your certificates and change your network settings without having to create new keys.

Consider that you can also use wildcards when issuing your certificate so that if you change some of your local domains the certificates will be still valid, or you can even use one certificate for all your servers (one certificate to rule them all).

Consider that you will have to have a local network DNS to achieve the best results (since it will be a PITA to edit every host file in every network machine).

2
  • Could you make me a domain example for the client?Sorry I am not an expert and,while for a server I can imagine an domain like domain.com I can't for a client which would be my pc name...
    – Phate
    Feb 28, 2014 at 7:13
  • 1
    Usually the domain name is the name of the machine itself. Also, I wouldn't specify an IP for client certificates unless they really have statics IPs, you can use wildcards for them if you want to =)
    – kiBytes
    Feb 28, 2014 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .