koichi sugimoto wrote: Could you try dNSName ?
----- So, thanks for the suggestion. It does "work around" the problem. In addition to the adding the IP address to the cert with "subjectAltName=IP:10.0.0.1"; I added the IP address twice (probably didn't need to), using "subjectAltName=IP:10.0.0.1,DNS:10.0.0.1" Doing this, the certificate is recognized as valid by both Firefox and IE for both "https://host.mydomain.com"; and "https://10.0.0.1"; I appreciate the suggestion (I had been thinking about trying it). So, while it corrects the issue, it appears that IE/Windows XP does not correctly handle a certificate with an IP added as an IP; but requires the IP to be listed as a DNS name (which, of course, it isn't). Bye - ted ----- > Hello: > > I have been trying to figure this out for the last week, and am unable to, > so I thought I would ask. I am not sure if this is the right place, but it > seemed a good place to start. > > Here is my issue: > > I have a apache web server which employs a virtual server for SSL > connections. > > I have a certificate for the web server. > > The certificate was created with openssl, and is X.509 V3. > > The certificates CN is the FQDN of the server (host.mydomain.com) > > The subjectAltName extension was used to add the hosts IP address to the > certificate (subjectAltName=IP:10.0.0.1). > > The certificate is installed on the web server. > > > > Now, using Firefox on Windows XP, I can go to either > https://host.mydomain.com or https://10.0.0.1"; and the page is displayed > and firefox recognizes that the certificate is valid for both the FQDN and > the IP address. > > > > But, using Internet Explorer on the same machine, going to > https://host.mydomain.com works fine (the certificate is identified, and > accepted as valid). > > However, using Internet Explorer and going to https://10.0.0.1 results in > a Certificate Error = The security certificate presented by this website > was issued for a different websites address. But, when I look at the > certificate from within IE, the subject alternative name is present and > matches the IP address entered into the browser. > > > > I think that this is almost certainly an issue with IE and/or windows XP > (not a surprise). Since the SSL authentication occurs before apache serves > the content, I dont think there is anything to do within apache to fix > this. I have read that MS requires magic numbers in certain certificates > for certain purposes (like with EAP-TLS authentication, I think), but I have > not been able to find any information if something similar is true here. > > > > While I think this may be a bit off topic for this list, I wasnt sure where > else to ask. > > Any help in understanding would be appreciated. > > Thanks > > Bye - ted ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected] ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
