Home / server / Questions / 770186
Accepted
Synetech
Asked: 2016-04-14 17:35:28 +0800 CST

(Self-signed) certificate with wildcards for localhost IPs (127…)

  • 772

Is there a way to create a (self-signed) certificate that will cover all localhost IPs such as the full range for 127?

I tried both 127.* and 127.*.*.* but neither worked; I still got SSL error pages warning me that the the page (e.g., 127.2.3.4) did not match the certificate and/or was not a trusted root, despite the fact that I had made sure to close the browser, remove the old one, and install the new one each time.

There’s some webpages that show how to use wildcards in subdomains, but not IPs.

wildcard ssl-certificate openssl

1 Answers

  1. Best Answer

    I assume that you are attempting to add the wildcard IP addresses as a Subject Alternate Name and not as the Subject (which doesn't allow IP addresses at all).

    RFC5280 Section 4.2.1.6 states:

    For IP version 4, as specified in [RFC791], the octet string MUST contain exactly four octets

    which rules out wildcard certs.

    Wildcards are only valid in names.

    • 5