A while ago I encountered a question asking how to setup SSL/TLS on intranets, I gave an answer which basically says "use a public domain and associated certificate and resolve the domain to the Intranet address of the server".

Is there a CA/B rule that prevents CAs from issueing certificates to private domains (e.g. mDNS *.local, and loopback localhost) and addresses? What's the general CA/B policy on this?


There is a rule adopted in 2012 by the CA/Browser Forum that prohibits certificate authorities from issuing SSL certs for internal names. All certificates for internal names issued beforehand were deprecated and expired before 2015. At this point it is not possible to get a certificate for a local private domain.

This rule covers several cases (reference digicert):

  • Internal private domains (.local and other top level domains specified not to resolve to public networks)
  • Unqualified domains (mail, web1, or any host name without a top level domain suffix.)
  • IP4 and IP6 IP addresses designated for local private networks. (It is possible to get a SSL certificate for a public IP address from some certificate authorities.)

The rationale behind this rule is that there is too much potential for abuse if local certificates are allowed. Anybody could get a certificate for mail.local. Using that certificate on an internal network would offer no guarantees abouth the authenticity of your local server.

There are two work arounds for servers on internal networks:

  1. Use public names. All internal servers can be assigned subdomain names from public domain names under public top level domains. You can then get individual or wildcard SSL certificates from certificate authorities. It is often convenient to get a wildcard certificate so that one cert can be used on all internal servers.
  2. Create your own private certificate authority and configure all the devices on your internal networks to trust it. Your private certificate authority could issue certificates for anything you want including private names.
  • You can find the rule at § of the document on github.com/cabforum/servercert/blob/master/docs/BR.md for example:"CAs SHALL NOT issue certificates with a subjectAlternativeName extension or Subject commonName field containing a Reserved IP Address or Internal Name." with the definitions at beginning of what is an Internal Name: "Internal Name: A string of characters (not an IP address) [..] that cannot be verified as globally unique within the public DNS at the time of certificate issuance because it does not end with a Top Level Domain registered in IANA's Root Zone Database.' Mar 31 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.