Hello:
I have been trying to figure this out for the last week, and am unable to,
so I thought I would ask. I am not sure if this is the right place, but it
seemed a good place to start.
Here is my issue:
I have a apache web server which employs a virtual server for SSL
connections.
I have a certificate for the web server.
The certificate was created with openssl, and is X.509 V3.
The certificate's CN is the FQDN of the server ("host.mydomain.com")
The subjectAltName extension was used to add the host's IP address to the
certificate ("subjectAltName=IP:10.0.0.1").
The certificate is installed on the web server.
Now, using Firefox on Windows XP, I can go to either
"https://host.mydomain.com"; or "https://10.0.0.1"; and the page is displayed
and firefox recognizes that the certificate is valid for both the FQDN and
the IP address.
But, using Internet Explorer on the same machine, going to
"https://host.mydomain.com"; works fine (the certificate is identified, and
accepted as valid).
However, using Internet Explorer and going to "https://10.0.0.1"; results in
a "Certificate Error" = "The security certificate presented by this website
was issued for a different website's address." But, when I look at the
certificate from within IE, the subject alternative name is present and
matches the IP address entered into the browser.
I think that this is almost certainly an issue with IE and/or windows XP
(not a surprise). Since the SSL authentication occurs before apache serves
the content, I don't think there is anything to do within apache to fix
this. I have read that MS requires "magic numbers" in certain certificates
for certain purposes (like with EAP-TLS authentication, I think), but I have
not been able to find any information if something similar is true here.
While I think this may be a bit off topic for this list, I wasn't sure where
else to ask.
Any help in understanding would be appreciated.
Thanks
Bye - ted
