Microsoft Internet Explorer and IP Addresses in Certificate SAN

A fairy long title, but it describes exactly what this post is about. Once again a post about a Microsoft product and the way it works (or rather doesn't work) with your average Internet standard.

This week I was busy with RADIUS, 802.1x, PKI and the protection of websites with SSL encryption. For the implementation of 802.1x, I needed a PKI environment, so I used the Microsoft Certificate Services for that purpose. Along the way, I needed an SSL certificate for an internal website, but this particular website needed to work properly based on different FQDN's and or IP addresses without throwing warining or errors regarding the SSL connection.

The way to do this is to add Subject Alternative Names (SAN) to the certificate. This enables you to access the website in different ways, e.g.;

• Access a webmail host from the internet based on its official FQDN (https://webmail.somedomain.com)
• Access the same webmail host from the inside of the corporate lan based on its internal name (https://webmail.acme.local)
• And access the host from legacy DNS-unaware software on its IP address (https://192.168.1.254)

Click to read more ...