2

I have a web application that runs on localhost. I have a self-signed certificate for tomcat configured but when loading the website on firefox, I get a security exception. Can I get a CA to sign my SSL certificate so that this error is not thrown?

  • Why not fix this by storing a security exception in firefox for localhost? – Axel May 30 '14 at 9:38
  • You can simply use a hostname in a domain you own to refer to your machine as long as the name lookup works, e.g. by adding it to /etc/hosts or hosts.txt. – Simon Richter May 30 '14 at 12:00
3

You can create your own CA certificate, add that as a root CA on your machine then use that CA to sign your SSL certificate. http://msdn.microsoft.com/en-us/library/ms733813.aspx

Alternatively, assuming you own a domain name of some form, you could probably create an A record for localhost.yourdomain.com and point it to 127.0.0.1. You should then be able to get an SSL certificate signed for localhost.yourdomain.com, which you can then use instead of localhost (albeit only from your machine).

1

You can't and you absolutely SHOULD NOT!

The main feature of X509 certificate signature in SSL/TLS is that a third party guarantees that you're actually connecting to a system that has been approved by the owner of a domain name (it is the assumption that you already know the relation between the domain name and the actual entity you're trying to interact with).

Issuing a certificate for a name that isn't uniquely linked to an entity does not allow that validation to take place: such a signed certificate wouldn't carry any guarantee.

The bright point, however, is that if the only way you're using SSL is to validate the server identity, then it simply it doesn't matter if the certificate is signed by a trusted CA: you should be using certificate pinning in any case (not that it matters much, mind you, since you can assume that if someone can hijack your service listening on the loopback address, he can also grab the private key associated with the certificate).

0

No you can't. You can get only certificates for domains you own, but you can't claim ownership to localhost.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.