Creating valid SSL Certificates for HTTPS without hostnames

Something a bit obscure when it comes to SSL certificates is the possibility to use the version 3 extention "subjectAltName IP:192.0.2.2" to create a valid certificate that allows you to access a site via its IPv4-address instead of a FQDN.

To specify this option, you need to use a configuration file, so it is a bit more complicated than the oneliner in my previous post.

This is the configuration file you need to create:
[ req ]
distinguished_name = req_dn
req_extensions     = v3_req

[ v3_req ]
subjectAltName   = IP:192.0.2.2
basicConstraints = CA:true

[ req_dn ]
commonName     = 192.0.2.2
commonName_max = 64

Save this as 192.0.2.2.config and then create a new key and a self signed certificate:

openssl req -config 192.0.2.2.config -new -x509 -nodes -sha256 -days 4096 -verbose -subj /CN=192.0.2.2/ -newkey rsa:4096 -extensions v3_req -keyout private/192.0.2.2.key -out certs/192.0.2.2.pem

I am unsure if there is a CA out there who will accept a CSR with this data in it and then sign it for you - If you have any experience with this, please post a comment and I will update the post!

Selfsigned certificates are, in most cases, not very useful. The exception is if everyone who is going to access the service is able to retrieve a copy of the certificate via some out of band channel and then trust that certificate. Save a copy of the certificate somewhere and then point your SSL client to that file as the CA cert, for example "-ssl_verity -ssl_cafile ~/ca/192.0.2.2.pem" for irssi /SERVER ADD or "-CAfile ~/ca/192.0.2.2.pem" for openssl s_client.