0

I have a Cisco C9300 and I am securing the access to the web console to it with the HTTPS server. I created a trustpoint for our CA and imported the CA cert as well as created a certificate for this device. I created an RSA KEY and I used the following lines to make the CSR and export the certificate:

crypto pki trustpoint my-trustpoint
  enrollment terminal pem
  subject-name C=US, ST=Pennsylvania, L=Pittsburgh, O=Business, OU=Department, CN=192.168.1.10
  subject-alt-name SWITCH1.DOMAIN.NET
  serial-number none
  ip-address 192.168.0.10
  revocation-check none
  rsakeypair RSA_KEY01
end

By experience I normally make the CN the host name but for most other devices I can put the IP Address as the SAN. On these Ciscos it will not accept the IP address as a SAN.

When I go the webpage by using the IP Address (which is what we normally use) it shows the certificate issued by the CA but the browser says it is insecure. Why does it say it is insecure when I have a valid certificate from the CA?

1 Answer 1

2

The certificate is invalid for the plain IP address because that address doesn't match either subject name or subject alternative name (SAN).

The IP address cannot be used as the subject name. If you can't add it as subject alternative name then you need to use the host name for access.

If you like to use the plain host name without domain for access then you should add that as SAN as well.

3
  • Adding this comment comment to talk about the answer. When doing this and adding an A record into DNS if you go to https:\\HOSTNAME it says the connection is insecure but if you use the https://HOSTNAME.DOMAIN.NET name then it shows secure. Not sure why this is because they are both registered to the certificate and both resolve.
    – JukEboX
    May 25, 2023 at 17:42
  • 1
    If you want to use HOSTNAME by itself then that exact name - without domain - needs to be either in the subject name or in the subject alternative name. Failing both, the connection isn't "secure".
    – Zac67
    May 25, 2023 at 18:32
  • @Zak67 HOSTNAME is in the SN. But the browser doesn't see the cert is secure unless I use the FQDN which is the SAN.
    – JukEboX
    May 30, 2023 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.