This question already has an answer here:
- How does SSL/TLS work? 3 answers
I have a private NAS device. It uses a self-signed SSL certificate. I can import the cert into Firefox and everything works as long as I'm accessing the device from somewhere on the internet. SSL validation and encryption is working.
Now, if I try to access the device through my LAN, I'm getting an error from firefox:
ssl_error_bad_certificate_domain. This happens, because I am accessing the device using its local IP address and not using the DDNS web address.
I may add the IP address to the to the Subject Alternative Names list in the Certificate, if it is static, to solve the problem. Let us consider the problem, when I cannot make it static, but it has to stay dynamic.
I read in the RFC 2818 that
If the client has external information as to the expected identity of the server, the hostname check MAY be omitted. (For instance, a client may be connecting to a machine whose address and hostname are dynamic but the client knows the certificate that the server will present.)
I know exactly that this certificate is the correct one. So, if the server can identify with the private key, everything is good. But, how do I know, whether Firefox checks the certificate even if the hostname check fails?