Could you try dNSName ?
2011/1/15 Ted Wynnychenko <[email protected]>: > Hello: > > I have been trying to figure this out for the last week, and am unable to, > so I thought I would ask. I am not sure if this is the right place, but it > seemed a good place to start. > > Here is my issue: > > I have a apache web server which employs a virtual server for SSL > connections. > > I have a certificate for the web server. > > The certificate was created with openssl, and is X.509 V3. > > The certificate’s CN is the FQDN of the server (“host.mydomain.com”) > > The subjectAltName extension was used to add the host’s IP address to the > certificate (“subjectAltName=IP:10.0.0.1”). > > The certificate is installed on the web server. > > > > Now, using Firefox on Windows XP, I can go to either > “https://host.mydomain.com” or “https://10.0.0.1"; and the page is displayed > and firefox recognizes that the certificate is valid for both the FQDN and > the IP address. > > > > But, using Internet Explorer on the same machine, going to > “https://host.mydomain.com” works fine (the certificate is identified, and > accepted as valid). > > However, using Internet Explorer and going to “https://10.0.0.1” results in > a “Certificate Error” = “The security certificate presented by this website > was issued for a different website’s address.” But, when I look at the > certificate from within IE, the subject alternative name is present and > matches the IP address entered into the browser. > > > > I think that this is almost certainly an issue with IE and/or windows XP > (not a surprise). Since the SSL authentication occurs before apache serves > the content, I don’t think there is anything to do within apache to fix > this. I have read that MS requires “magic numbers” in certain certificates > for certain purposes (like with EAP-TLS authentication, I think), but I have > not been able to find any information if something similar is true here. > > > > While I think this may be a bit off topic for this list, I wasn’t sure where > else to ask. > > Any help in understanding would be appreciated. > > Thanks > > Bye - ted ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
