Becoming Certificate Authority and Generating a Certificate

A quick question.

I sign a certificate for PKILabServer.com (Listed under Common Name),

open /etc/hosts and add the following entry 127.0.0.1 PKILabServer.com

Then launch the server using the command % openssl s_server –cert server.pem -www

I point the browser to and then it shows "Invalid security certificate..." and then I load my certificate file ca.crt and the website loads perfectly.

The question is that, since PKILabServer.com points to the localhost, if we use instead, we will be connecting to the same web server.

But when I point the browser to localhost:4433 , I get an error saying "This certificate is valid only for pkilabserver.com..." I'm required to explain the reason for this in my project, and this is what I answered. Please correct me if I'm wrong.

This is because the Certificate Signing Request that was generated was signed exclusively for PKILabServer.com (as it was listed under Common Name) Since the /etc/hosts file had entries for a lot of other websites which were listed under localhost, hence pointing the browser to localhost:4433 would take the website listed in the /etc/hosts file and since the websites don’t match, we get the error that “The certificate is only valid for PKILabServer.com”

1 Answer

I think you are confusing the role of an IP address and domain name with respect of HTTPS connections.

A certificate (in context of HTTPS) has no knowledge of IP addresses and cares even less - all it cares for is the domain name(s) it is associated with - and these are hardcoded into the cert.

When your HTTPS connection is being established, the domain name is passed using a header ("host: xxxx") - and the cert validates against this, regardless of the Interface it comes in on.

Hence when you go to localhost:XXX the cert does not match because localhost is not in the hosts line of the header and it throws up an error. Similarly, mapping 127.0.0.1 to the domain name and using the domain name works fine.

[ I note, for the sake of completeness, that I assume the Virtualhost can bind to any IP with the same config ]