Search code examples
opensslssl-certificatebackend

How to sign an SSL certificate for an IP address?

I have a server that hosts ONLY the node backend (I'm using express) of my website in a machine in my house and I want to call this server from another backend (we're trying to build an API system that can help us with our main backend).

I need an SSL certificate and I need to verify it using a CA but I'm stuck at this point. How can I verify the SSL? I tried to use zeroSSL but it doesn't work because I'm trying to sign a certificate for an ip address since I don't have a DNS.

Example: I want to call my endpoint not like this

http://X.X.X.X:port#/endpoint

But like this:

https://X.X.X.X:port#/endpoint

Any help would be appreciated.

Solution

  • zeroSSL actually WILL issue free certificates for IPV4 addresses (IPV6 seems to not work at this time and I'm not aware of any other free options for IPV6 IPs)

    see https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address-

    you didn't say what kind of trouble you ran into but it's not a complex process

    as mentioned in the document, you MUST use HTTP verification (upload a file to your server)

    General process:

    1. Press "New Certificate"
    2. For the "domain name" just enter your IP
    3. select 90-day certificate
    4. auto-generate CSR
    5. select the Free plan
    6. choose "HTTP File Upload" verification
    7. download the file
    8. upload it to your web server in the directory /.well-known/pki-validation/ (create directories as needed)
    9. complete the verification
    10. download your certificate

    Alternatives to ZeroSSL -- I'm not aware of any others that will issue free certificates for IP addresses, but there are some workarounds that don't require buying a domain. You can easily utilize subdomains of https://sslip.io/ , https://nip.io/ , or similar services. No setup required -- for example if your IP is 1.1.1.1, DNS names 1-1-1-1.sslip.io and 1-1-1-1.nip.io will automatically resolve to it. So you can easily get SSL certificates for one of those subdomains those subdomains using LetsEncrypt. Those should work for IPV6 IPs as well but specific to IPV6 there's also https://has-a.name/ which works similarly

    Update: under current ZeroSSL policies, you can only do this (for free) 3 times per account. After that, you'll either have to pay or make a new account.