TLS Connection secure with hostname but not with IP

[krutika_ag]

I recently received CA Certificates from my Organization´s PKI Team.

In CSR, I provided Server Hostname in CN and SAN and hence when I am accessing the GUI using hostname the connection is secure.

But when I access it with IP, it is not secure.

So, do I need to provide IP in SAN?

Is there an alternate way, that the browser should only be accessible through hostname:8000 and not IP:8000

Please pour in your suggestions

[Pottsnet2]

Hello,

For your connection to be shown as secure going to hostname and IP, both have to be on the certificate.  In our environment, each server has a fqdn (i.e. server1.MyBiz.com) for their connection on the production network, and a fqdn (i.e. server1.MyBiz.local) for their connection on the local admin network. So their certificates are requested with CN of the production network fqdn, and a SAN of the admin network SAN. And because we want to continue to access them securely if/when DNS has a bad day, their public and private IP addresses also get SANs.  Maybe lucky, but we've not had any problems getting certificates with multiple SANs.

Hope this helps!

[PickleRick]

For the connection to be secured, the name of the host must match the name in the certificate. So if you're connecting to FQDN, your cert must contain the FQDN. If you want just the hostname, you must have the hostname. If you only have FQDN in the cert and connect to just hostname, you'll get an alert. Same goes for IP.

As a side note it's quite typical for CAs to be reluctant to issue certs for IPs.