They also will match a name in both the Common Name (CN) and the Subject Alternate Name (SAN). Other user agents allow any name in the Subject Alternate Name (SAN). They will sometimes allow a Private IP from RFC 1918, Address Allocation for Private Internets. Putting the server name in the Common Name is a waste of time and energy because browsers require host names in the SAN.īrowsers do not match a public IP address in the SAN. If the hostname is missing from the SAN, then the match will not occur. Some want a traditional hostname found in DNS, while others allow IP addresses.īrowsers only allow DNS hostnames in the Subject Alternate Name (SAN). The RFCs are more relaxed that CA/B issuing policies.ĭifferent user agents have different policies that apply to DNS names.
#PSO CITECT WEBDEPLOYMENT 8.2 VERIFICATION#
Other user agents, like cURL and Wget, follow IETF issuing and validation policies, like RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile and RFC 6125, Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS). They are the CA/Browser Forum, and the Internet Engineering Task Force (IETF).īrowsers, Like Chrome, Firefox and Internet Explorer, follow the CA/B Baseline Requirements (CA/B BR). There are two bodies which dominate issuing/validation policies. then it should succeed if the certificate includes and fail otherwise. If you connect using another user agent via. Generally speaking, suppose has a IP address of If you connect via. So to give you a precise answer, we need to know more about your configuration. It depends on the issuing/validation policies, user agents, and the version of OpenSSL you are using. Why do we get bad certificate error while accessing the server using IP address instead dns name?