Security

TLS Connection secure with hostname but not with IP

krutika_ag
Path Finder

I recently received CA Certificates from my Organization´s PKI Team.

In CSR, I provided Server Hostname in CN and SAN and hence when I am accessing the GUI using hostname the connection is secure.

But when I access it with IP, it is not secure.

So, do I need to provide IP in SAN?

Is there an alternate way, that the browser should only be accessible through hostname:8000 and not IP:8000

 

Please pour in your suggestions

Labels (1)
Tags (4)
0 Karma

Pottsnet2
Loves-to-Learn

Hello,

For your connection to be shown as secure going to hostname and IP, both have to be on the certificate.  In our environment, each server has a fqdn (i.e. server1.MyBiz.com) for their connection on the production network, and a fqdn (i.e. server1.MyBiz.local) for their connection on the local admin network. So their certificates are requested with CN of the production network fqdn, and a SAN of the admin network SAN. And because we want to continue to access them securely if/when DNS has a bad day, their public and private IP addresses also get SANs.  Maybe lucky, but we've not had any problems getting certificates with multiple SANs.

Hope this helps!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

For the connection to be secured, the name of the host must match the name in the certificate. So if you're connecting to FQDN, your cert must contain the FQDN. If you want just the hostname, you must have the hostname. If you only have FQDN in the cert and connect to just hostname, you'll get an alert. Same goes for IP.

As a side note it's quite typical for CAs to be reluctant to issue certs for IPs.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...