IP range in SSL subject alternative name

No

(EDIT: This was a much longer post. I was speculating about wildcards. Turns out: It's much simpler.)

You can't do it.

RFC 5280 says:

When the subjectAltName extension contains an iPAddress, the address
MUST be stored in the octet string in "network byte order", as
specified in [RFC791].  The least significant bit (LSB) of each octet
is the LSB of the corresponding byte in the network address.  For IP
version 4, as specified in [RFC791], the octet string MUST contain
exactly four octets.  For IP version 6, as specified in
[RFC2460], the octet string MUST contain exactly sixteen octets.

So there is just no room for any wildcards.

Note:
Now in the past there was a way to put an IP address in a SAN field of type DNS (!). This was always dodgy. But there at least, you might have had the additional room for wildcarding tricks.

Firstly, it is possible to hold 192.168.0.0/24 in the SubjectAltName Field. However, this kind of certificate is not being trusted by any browser.

I will give you an example:
Here's a certificate issued from my own PKI.

RSA-2048 Certificate

RSA-2048 Key

Viewing this certificate in Windows 10, you can find

IP Address=192.168.0.0
Mask=255.255.255.0

In the Subject Alternative Name Field, which proved that SubjectAltName can be a range of IPs.

This kind of not trusted at all!
You can try it by yourself:
Deploy this certificate on a machine whose IP is in the range from 192.168.0.1~192.168.0.254. And trust my root certificate in your computer (My root certificate can be found in the cert path, whose name is JemmyLoveJenny EV Root CA)

I've tried many times, no matter I use IE, Edge, Chrome or FireFox, none of them trust this certificate. The error code returned is "NET::ERR_CERT_COMMON_NAME_INVALID", which means neither the CommonName nor the SubjectAltName matches the IP 192.168.0.1.

In conclusion, it is possible to embed range of IPs in the SubjectAltNames Field. But none of the modern browsers would trust this kind of certificate.

To add to what StackzOfZtuff said, you can't have a range of IP addresses in a cert. But you can have multiple IP addresses there. So put the entire range of addresses in the cert. I'm unsure of what the upper limit is, but it's something greater than 254 IPv4 addresses. It's not technically a network range (there is no wildcard) but you get the same benefit, one cert for multiple IPs. I did some testing with this OpenSSL configuration file to generate a CSR and I had it signed by an internal CA:

req_extensions = v3_req
distinguished_name = req_distinguished_name
default_bits = 4096
default_md = sha256
prompt = no
[req_distinguished_name]
C = ...
ST = ...
L = ...
OU = ...
O = ...
CN = 192.168.0.0

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName = @alt_names
[alt_names]
IP.1 = 192.168.0.1
IP.2 = 192.168.0.2
IP.3 = 192.168.0.3
...
IP.254 = 192.168.0.254

Firefox and Chrome were both happy with the generated certificate. The CA admin also added DNS.1 = 192.168.0.0 while signing it. I'm not positive if that was strictly required or not.

IP range in SSL subject alternative name

No

Tags:

Openssl

Tls

Related

Recent Posts