2

My application has static front-end content as well as a backend server. I already have an existing mechanism to serve the front-end; I'm running the backend in an AWS EC2 (with Elastic IP). Throughout the course of its operation, my front-end initiates https requests to my backend (currently to its bare IP). I need a proper CA certificate (not self-signed), or else chrome will block these requests.

what is the standard practice here? it looks like standard certificate providers (e.g., Let's Encrypt) refuse to issue certificates to bare IPs. On the other hand, it seems like overkill to get a custom domain name just for this backend, seeing as users never access it directly (rather, the front-end pings it for them), and they already have a way to get the front-end. in particular, it would be fine if my "domain name" were just a random string of letters.

finally, I need a fully running server in the backend, not just static "hosting".

how should I proceed? many thanks in advance; apologies if this is basic.

2
  • 1
    Why are you using Chrome to connect between your front end and your back end? Usually that connection is handled by a reverse proxy such as one built into Apache or Nginx. Chrome wouldn't usually figure into that at all. Dec 3, 2021 at 2:05
  • 3
    Why not just assign a subdomain to the backend? So, end users visit your website at www.example.com, and your web pages make calls to api.example.com which points to your EC2 instance? Dec 3, 2021 at 2:05

1 Answer 1

3

You will need to assign a domain name to the IP to be able to use any CA - no reputable (ie included in browsers/OS's) will sign an IP address (unless you are in the tiny minority of organisations who own their own IP block and as per whois records as pointed out by Patric in his comment below) as that is wide open to abuse, and its difficult to prove ownership.

As MaximillianLaumeister said, the easiest way to do this is to assign a subdomain to the backend and then use a CA like letsencrypt to sign it.

The alternative is to create your own CA, sign the cert and add the CA to your browser. This is doable but likely more work then its worth. You can create your own CA with OpenSSL, and there are wrappers like EasyRSA to make it easier. Apparently you can specify an IP address for the Subject Name.

4
  • 2
    "no reputable (ie included in browsers/OS's)" Really? This case is completely covered by the CAB Forum guidelines, and is not a problem per se. See sectigostore.com/page/ssl-certificate-for-ip-address for one existing example, and there are others. Dec 3, 2021 at 17:28
  • 1
    "as that is wide open to abuse, and its difficult to prove ownership." See "3.2.2.5 Authentication for an IP Address" at github.com/cabforum/servercert/blob/main/docs/BR.md for details on how "ownership" has to be asserted in this case. Dec 3, 2021 at 17:30
  • Intersting, but from your own link - "A certificate authority must be able to verify your IP ownership under an IP WHOIS lookup. Your organization’s name, physical address, phone number, and email id must be shown in the IP WHOIS lookup. " - It goes on to confirm that this myst be your, not your hosting providers IP - which rules out Elastic IP and almost all IP addresses (unless you are a hosting company with an RIR membership and IP space)
    – davidgo
    Dec 3, 2021 at 17:42
  • Yes, of course, if you ask for a certificate asserting the identity of an IP address in fact you assert control of that IP address, so it needs to be "yours" for some definition of ownership. HTTPS URLs with IP addresses instead of names are a bad idea in general (of course, counter example: 1.1.1.1 as this case is far more relevant for DNS over HTTPS of course if you want to avoid a chicken and egg problem), hence I advocate to use only names. But they (that is certificate with IP addresses) exist. Far more widespread in other areas though, like RPKI. Dec 3, 2021 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.