0

I am getting this error in my device:

javax.net.ssl.SSLException: hostname in certificate didn't match: <ec2-5-43-58-857.us-east-2.compute.amazonaws.com> != <na>

So I did some research and found I could set alternative IP address in an OpenSSL config and then generate new keys/certs.

This is my config

[ubuntu@ip-172-31-25-95 ~] 2020-10-09 14:19:07$ cat san.cfg
[req]
default_bits  = 2048
distinguished_name = req_distinguished_name
req_extensions = req_ext
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
countryName = XX
stateOrProvinceName = N/A
localityName = N/A
organizationName = Self-signed certificate
commonName = 120.0.0.1: Self-signed certificate
[req_ext]
subjectAltName = @alt_names
[v3_req]
subjectAltName = @alt_names
[alt_names]
IP.1 = ec2-5-43-58-857.us-east-2.compute.amazonaws.com

But when I run:

sudo openssl req -x509 -days 36500 -newkey rsa:2048 -keyout ./key_elastic.pem -out ./cert_elastic.pem -config ./san.cfg

I get this error:

140515677422016:error:220A4076:X509 V3 routines:a2i_GENERAL_NAME:bad ip address:../crypto/x509v3/v3_alt.c:457:value=ec2-5-43-58-857.us-east-2.compute.amazonaws.com
140515677422016:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:../crypto/x509v3/v3_conf.c:47:name=subjectAltName, value=@alt_names

Mind you, everything was working fine until I switched to an elastic IP address for server. I made new keys they same way I did before. But then I got the first device error I mentions at the top of the post.

Adam Paul
  • 1

1 Answers1

1
[alt_names]
IP.1 = ec2-5-43-58-857.us-east-2.compute.amazonaws.com

IP.1 expects an IP address, i.e. something like 10.11.12.13. You've given a domain name instead. In this case use DNS.1 not IP.1.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424