Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Support IPs and multiple Subject Alt Names in the TLS certificate #190

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

1ma
Copy link
Contributor

@1ma 1ma commented Jun 28, 2023

The current DOMAIN option is a bit too restrictive, as it only allows registering one Subject Alt Name on the self-signed TLS certificate, and it must be a DNS domain. When c-lightning-REST is hosted on a machine without an associated domain these certificates cannot be used to validate the responses.

The new IP configuration option allows setting an static IP as Subject Alt Name. Its default value is 127.0.0.1, which is backwards compatible.

Additionally, I've tweaked both options to allow multiple comma-separated values, as the openssl tool also supports multiple SANs.

Examples

openssl x509 -in certs/certificate.pem -text -noout has been used to decode these certificates.

master branch, default DOMAIN:

...
X509v3 Subject Alternative Name:
    DNS:localhost

Multi SAN PR, default DOMAIN and IP:

...
X509v3 Subject Alternative Name: 
    DNS:localhost, IP Address:127.0.0.1

Multi SAN PR, custom DOMAIN and IP:

DOMAIN: localhost,example.com,ln.example.com
IP: 127.0.0.1,1.2.3.4

...
X509v3 Subject Alternative Name: 
    DNS:localhost, DNS:example.com, DNS:ln.example.com, IP Address:127.0.0.1, IP Address:1.2.3.4

@saubyk saubyk self-requested a review July 1, 2023 19:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant