Securing a private IP address (https certificate) – Stack Overflow
I have an unusual use case:
a web server on the Internet is serving pages through HTTPS,
inside those web pages, there are calls to XMLHttpRequests to a locally connected device (IP over USB)
the device supports both HTTP and HTTPS,
the device is accessible on (s)192. 168. 0. 1
the calls fail because of insecure content in a page,
the calls fail because the certificate is not trusted (self-signed),
Side question: Since the device is locally connected to the PC, the encryption is pretty useless: Does a header exists that allows insecure connections to a specific URL? (like CORS for cross domain)
Main question: Is it possible to obtain a certificate for a private IP address?
Edit: it seems that Plex had a similar problem and solved it the way described on this blog. This is a way too big for me.
asked Jun 30 ’16 at 14:03
XvolksXvolks1, 9591 gold badge18 silver badges28 bronze badges
Is it possible to obtain a certificate for a private IP address?
A certificate can be bound to an IP address (see this). You can issue a self-signed certificate to a private address, but a trusted CA will not issue a certificate to a private address because it can not verify its identity.
For example a certificate issued to 192. 1 would be theoretically valid in any context, and this should not be allowed by a trusted CA
Plex solves the problem with a Dynamic DNS and a wildcard certificate. The connection are done using the name (not the IP) of the device which is resolved to the private IP
Does a header exists that allows insecure connections to a specific URL? (like CORS for cross domain)
No, it does not exist. The browser blocks your XHR connections because they are HTTP connections initiated from a HTTPS page (mixed-content warning). Non-secure content can theoretically be read or modified by attackers, even though the parent page is served over HTTPs, so is normal and recommended that the browser warns the user.
To fix the mixed-content and errors, you could serve the content through HTTPS and a self-signed certificate, and request users to import your root CA at browser.
answered Jul 1 ’16 at 6:42
pedrofbpedrofb32k4 gold badges72 silver badges125 bronze badges
4
An SSL certificate cannot be issued for Reserved IP addresses (RFC 1918 and RFC 4193 range)/ private IP addresses (IPv4, IPv6), Intranet for Internal Server Name, local server name with a non-public domain name suffix.
You could however use a ‘self-signed’ certificate. Here’s how to create one:
Creating a Self-signed Certificate for a private IP
(example):
You need OpenSSL installed.
For example, on Ubuntu, you could install it by: sudo apt-get install openssl
(It may already be installed. Type “openssl version” to find out)
For Windows, you could try this:
Once OpenSSL is installed, go to OpenSSL prompt by entering ‘openssl’ on the console (LINUX), or the cmd prompt (WINDOWS).
$ openssl
OpenSSL>
Now do the following steps to create: Private key, Certificate Request, Self-signing the certificate, and putting it all together, by using the below commands:
i) Create KEY called
OpenSSL> genrsa -out 2048
ii) Use the key to create a Certificate request called
You could accept the default options, or specify your own information:
OpenSSL> req -new -key -out
iii) use the above to create a certificate:
OpenSSL> x509 -req -days 1825 -in -signkey -out
iv) Put all the above to create a PEM certificate:
exit OpenSSL (OpenSSL> q) and go to certificate location and do:
$ sudo cat >>
is your self-signed certificate. You can use this in requests like if your server supports. Remember to check the port number for (443).
answered Oct 5 ’20 at 18:47
2
Not the answer you’re looking for? Browse other questions tagged ssl cross-domain or ask your own question.
Securing a private IP address (https certificate) – Stack Overflow
I have an unusual use case:
a web server on the Internet is serving pages through HTTPS,
inside those web pages, there are calls to XMLHttpRequests to a locally connected device (IP over USB)
the device supports both HTTP and HTTPS,
the device is accessible on (s)192. 168. 0. 1
the calls fail because of insecure content in a page,
the calls fail because the certificate is not trusted (self-signed),
Side question: Since the device is locally connected to the PC, the encryption is pretty useless: Does a header exists that allows insecure connections to a specific URL? (like CORS for cross domain)
Main question: Is it possible to obtain a certificate for a private IP address?
Edit: it seems that Plex had a similar problem and solved it the way described on this blog. This is a way too big for me.
asked Jun 30 ’16 at 14:03
XvolksXvolks1, 9591 gold badge18 silver badges28 bronze badges
Is it possible to obtain a certificate for a private IP address?
A certificate can be bound to an IP address (see this). You can issue a self-signed certificate to a private address, but a trusted CA will not issue a certificate to a private address because it can not verify its identity.
For example a certificate issued to 192. 1 would be theoretically valid in any context, and this should not be allowed by a trusted CA
Plex solves the problem with a Dynamic DNS and a wildcard certificate. The connection are done using the name (not the IP) of the device which is resolved to the private IP
Does a header exists that allows insecure connections to a specific URL? (like CORS for cross domain)
No, it does not exist. The browser blocks your XHR connections because they are HTTP connections initiated from a HTTPS page (mixed-content warning). Non-secure content can theoretically be read or modified by attackers, even though the parent page is served over HTTPs, so is normal and recommended that the browser warns the user.
To fix the mixed-content and errors, you could serve the content through HTTPS and a self-signed certificate, and request users to import your root CA at browser.
answered Jul 1 ’16 at 6:42
pedrofbpedrofb32k4 gold badges72 silver badges125 bronze badges
4
An SSL certificate cannot be issued for Reserved IP addresses (RFC 1918 and RFC 4193 range)/ private IP addresses (IPv4, IPv6), Intranet for Internal Server Name, local server name with a non-public domain name suffix.
You could however use a ‘self-signed’ certificate. Here’s how to create one:
Creating a Self-signed Certificate for a private IP
(example):
You need OpenSSL installed.
For example, on Ubuntu, you could install it by: sudo apt-get install openssl
(It may already be installed. Type “openssl version” to find out)
For Windows, you could try this:
Once OpenSSL is installed, go to OpenSSL prompt by entering ‘openssl’ on the console (LINUX), or the cmd prompt (WINDOWS).
$ openssl
OpenSSL>
Now do the following steps to create: Private key, Certificate Request, Self-signing the certificate, and putting it all together, by using the below commands:
i) Create KEY called
OpenSSL> genrsa -out 2048
ii) Use the key to create a Certificate request called
You could accept the default options, or specify your own information:
OpenSSL> req -new -key -out
iii) use the above to create a certificate:
OpenSSL> x509 -req -days 1825 -in -signkey -out
iv) Put all the above to create a PEM certificate:
exit OpenSSL (OpenSSL> q) and go to certificate location and do:
$ sudo cat >>
is your self-signed certificate. You can use this in requests like if your server supports. Remember to check the port number for (443).
answered Oct 5 ’20 at 18:47
2
Not the answer you’re looking for? Browse other questions tagged ssl cross-domain or ask your own question.
What is an IP address SSL certificate? – SSL247
KB >>
SSL Certificates >>
General Information >>
What is an IP address SSL certificate?
WHAT IS AN IP ADDRESS SSL CERTIFICATE?
An IP address SSL certificate secures connections directly with the IP address submitted. Whereas typically an SSL certificate is issued to a Fully Qualified Domain Name (FQDN), some organisations may need to secure an IP address.
Only public IP addresses may be used and you must be the owner of the IP address according to the records at RIPE.
GlobalSign OrganizationSSL for IP
Frequently Asked Questions about what is private ssl and ip
Can I get an SSL for Private IP?
An SSL certificate cannot be issued for Reserved IP addresses (RFC 1918 and RFC 4193 range)/ private IP addresses (IPv4, IPv6), Intranet for Internal Server Name, local server name with a non-public domain name suffix.Oct 6, 2020
What is SSL IP?
An IP address SSL certificate secures connections directly with the IP address submitted. Whereas typically an SSL certificate is issued to a Fully Qualified Domain Name (FQDN), some organisations may need to secure an IP address.
What is IP private IP?
Type: ipconfig and press ENTER. Look at the result and look for the line that says IPv4 address and IPv6 address . What is marked in red are your private IPv4 and IPv6 addresses . You’ve got it!
