/ Register

Welcome to Centmin Mod Community
Become a Member

Ip ssl

Discussion in 'Domains, DNS, Email & SSL Certificates' started by lostincable, Mar 16, 2022.

Previous Thread Next Thread
Loading...
  1. Mar 16, 2022 #1
    lostincable

    lostincable New Member

    24
    2
    3
    Feb 17, 2018
    Ratings:
    +3
    Local Time:
    7:48 PM
    The server IP address when centminmod is setup is using http by standard.

    Can an ssl be generated for the server ip so if people access the server ip they get an ssl centminmod page for the base centminmod install?

    From my reading letsencrypt doesn’t issues ssl for IP addressees so interested to know what others do to secure the default IP address of a server.
     
  2. Mar 16, 2022 #2
    eva2000

    eva2000 Administrator Staff Member

    58,895
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:48 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Browser validated/trusted SSL certificates are issued for hostname/domain names, not IP addresses. Generally, you don't want SSL certificates for the main hostname/IP anyway as every time you issue an SSL certificate, the certificate can be publicly searched for via Certificate Transparency logs at crt.sh | Certificate Search and Certificate Transparency Monitoring - Facebook for Developers. See https://securitytrails.com/blog/what-are-certificate-transparency-logs for an explanation of CT logs.

    What this means is malicious folks can also search the CT logs for hostnames belonging to an attacker who wants to target your domain and see if you have any exposed hostnames listed in CT logs. Once you issue a browser trusted SSL certificate, you better be prepared to protect it too.

    If you don't plan on having sites other than default Nginx HTML index page served from main hostname/IP, then having a browser trusted SSL certificate/HTTPS isn't essential. You can probably use a self-signed non-browser trusted SSL certificate just as well to encrypt data but not log to CT logs the hostname + then empty the main hostname index page at /usr/local/nginx/html/index.html as a blank page serving nothing. Or just keep it non-https + then empty the main hostname index page at /usr/local/nginx/html/index.html as a blank page serving nothing
     
Previous Thread Next Thread
Loading...

.