Web Access Certs No Secure Though It Is

Question

I have a Cisco C9300 and I am securing the access to the web console to it with the HTTPS server. I created a trustpoint for our CA and imported the CA cert as well as created a certificate for this device. I created an RSA KEY and I used the following lines to make the CSR and export the certificate:

crypto pki trustpoint my-trustpoint
  enrollment terminal pem
  subject-name C=US, ST=Pennsylvania, L=Pittsburgh, O=Business, OU=Department, CN=192.168.1.10
  subject-alt-name SWITCH1.DOMAIN.NET
  serial-number none
  ip-address 192.168.0.10
  revocation-check none
  rsakeypair RSA_KEY01
end

By experience I normally make the CN the host name but for most other devices I can put the IP Address as the SAN. On these Ciscos it will not accept the IP address as a SAN.

When I go the webpage by using the IP Address (which is what we normally use) it shows the certificate issued by the CA but the browser says it is insecure. Why does it say it is insecure when I have a valid certificate from the CA?

Answer 1

The certificate is invalid for the plain IP address because that address doesn't match either subject name or subject alternative name (SAN).

The IP address cannot be used as the subject name. If you can't add it as subject alternative name then you need to use the host name for access.

If you like to use the plain host name without domain for access then you should add that as SAN as well.