Peerobyte / Community / Questions & Answers / Why is my SSL certificate not working for my IP address in Apache?

Why is my SSL certificate not working for my IP address in Apache?

I have a website running on Apache, and I’m trying to set up an SSL certificate for it. When I visit https://192.168.1.1 in Firefox, I get the following error:

		

			
		

		Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for 192.168.1.1. The certificate is only valid for 192.168.1.1.


Error code: SSL_ERROR_BAD_CERT_DOMAIN

I created a certificate for the IP address 192.168.1.1 using OpenSSL with the following configuration file:

		

			
		

		[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no


[req_distinguished_name]
C = US
ST = NY
L = New York
O = Example
OU = IT
CN = 192.168.1.1


[v3_req]
keyUsage = critical, digitalSignature, keyAgreement
extendedKeyUsage = serverAuth
subjectAltName = @alt_names


[alt_names]
DNS.1 = 192.168.1.1

I configured Apache to use this certificate. However, when I try to access the site via the IP address in the browser, Firefox does not trust the certificate. What am I doing wrong?

Luca Rossi

7 months ago

2 answers

115 views

Rating

02
Answer

Answers

Pierre Moreau

7 months ago

Rating

00

Even with the correct IP.1 setting, the browser will only trust the certificate because you manually added the root certificate on your device. Typically, SSL certificates are issued for domain names, not IP addresses, so other devices may not automatically trust certificates for IP addresses, even if correctly configured in subjectAltName. Such a certificate will not be "fully trusted" on other devices unless they are configured similarly to yours.

Reply

Nicolas Janssens

7 months ago

Rating

00

The issue is that for IP addresses, you need to specify them in the subjectAltName section as an IP, not as a DNS. Here’s the corrected configuration:

		

			
		

		[alt_names]
IP.1 = 192.168.1.1

For an IP address, the certificate must reference it as IP.1 instead of DNS.1. This should resolve the browser error you're seeing.

Reply