Using HTTPS with a dynamic ip

ssl web dynamic-ip
Agent T picture Agent T · Jan 23, 2015 · Viewed 18k times · Source

My situation: I want to run a webserver on a device in an unknown network. Requests on port 80 or 443 will be forwarded to this device from the global ip.

The device regularly posts its IP address to a server on the web and it is saved on this server.

Is it possible to access this device via https without much trouble? The problem of course is, that the ip can change and a SSL certificate needs to have a hostname.

Edit: The device doesn't have a domain assigned to it that I could use for a certificate. Is it maybe possible to use a domain I own and reroute that to the dynamic ip without changing the header? As far as I understand it that would make using https possible

Answer

deceze picture deceze · Jan 24, 2015

The common wisdom of SSL certificates being associated with one IP address is misleading. An SSL certificate is issued for the domain name, not the IP address. The issue with IP addresses stems from the details of the HTTPS protocol, and namely just the issue of name resolution. An HTTP server can host many different sites for many different domains, all on the same port and IP address. It knows which site is being requested based on an HTTP header.

Now, with HTTPS, the server first needs to negotiate a secure SSL connection before any HTTP headers are exchanged. The issue therefore is that it can't know which certificate for which domain it's supposed to use to negotiate a secure connection, because it hasn't yet had a chance to talk to the client about the domain it'd like to visit.

There are actually mechanisms for name negotiation before encryption in later versions of the HTTPS protocol, but the practical problem is that older clients do not support it yet (stare at IE6).

So the practical solution is to reserve one IP address and/or port for each HTTPS site, because then there's no issue of multiple name resolutions. One IP/port is reserved for one specific HTTPS site and in extension for one SSL certificate.

Which means, as long as your server is only serving one HTTPS domain, its IP address can change as often as it wants; there's no issue there.

Related questions

Forcing SSL and WWW using .htaccess

I would like to know if this code in .htaccess for forcing SSL and WWW in URL is correct, because with another codes I usually get redirect loop, e.g. RewriteCond %{HTTPS} !=on and now it works like a charm (…

Read More
How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More