Is it possible to have one SSL cert that works across several web servers? For example, 300 servers in unique geological locations that all point to unique sites.

@DavidFreitag You can have a single wildcard in the server alternative name (SAN) field, but not for entirely different domain names, no.

@TildalWave Wrong.

@Adnan yes?

@TildalWave No

@DavidFreitag You can have a lot of names in the Subject Alt Name extension of the certificate.

So, basically, yes.

They won't be linked to a FQDN, they will only be accessible by ip address.

oh... yes ... that ^^what the bear said :))

@DavidFreitag Then you lose.

HTTPS clients (Web browser) require matching the name in the URL with the one in the certificate.

They don't do that for IP addresses.

No name, no match, no SSL

(or, at least, no SSL without a red scary warning)

We have an existing set of instrumentation that we are in the process of upgrading, including internet capabilities. One of my plans is to make the data (usually accessible through RS232 or something like that) available through a web form.

@TildalWave I hope you learned your lesson today.

you could assign a subdomain to each one

In most cases these instruments are in remote sites not physically accessible by technicians, so it would be great of we could use the interwebs to access them.

@Adnan since when did I care about "certification"? :P

say 123-456-789-012.mydomain.com

@TildalWave We don't answer X.509-related questions when Thomas is around.

@Adnan joking... I just forgot the option of having more than one name there

and if you don't use a standard browser, you, you don't need certificates at all

I knew the answer for that, but I also knew that whatever I say, Thomas will say it better, making mine look wrong.

The issue with a subdomain for each instrument is that we have hundreds of customers with each having hundreds of instruments... i dont think a few thousand subdomains will really be feasible...

@Adnan oh that :)) yes... I know that, but YOLO man!!

@DavidFreitag can you install custom root certs on those instruments?

I'm not an expert on DNS servers, but I'd guess that large amounts of subdomains are no big deal

@TildalWave The hardware for the new generation systems is going to be linux based with a 1GHz cpu, i would assume so unless the necessary code hasn't been ported to the version of rt linux we decide to use.

@CodesInChaos not really, you can script it even in some panels

problem with one cert is that all of the devices share a private key. Extract one, break all

@CodesInChaos What was the limit? 15m?

@CodesInChaos couldn't he install a new trusted CA of his own and then sign any new certs with this CA's private key and have them both accepted by the device as well as have their own keys?

I mean, we could do a different subdomain for each instrument, the problem then becomes finding what the ip address of the instrument will be once it's in place...

@Adnan Limit on what? Zone files?

nvm

Most of these things will be placed in a metal box in a remote site in europe somewhere inconspicuous.

Well, thanks for the help. Methinks i need to rethink this whole web server thing. It would be nifty if i could get ARP packets to propagate across all the routers in the world to find the instrument i'm looking for.

Wiretapping? That's for noobs like the NSA. We distribute billions of bugs all over Europe so we can grab the data before it even gets encrypted.

@CodesInChaos Nah, its for gathering environmental data, like ozone levels and temperature/humidity etc.

Yes, yes, that's what you'd like us to believe. You can't FOOL ME!1!!

If our instruments were bugs or wire-taps, the EPA would be screwed, as well as most of india and south america, lol.

Hm, my psych final is in two hours and i haven't studied at all for it. I'm not sure whether i should be stressing out right now.

Yes, it was a great reply.

I am honestly not sure if he's joking or not...

He's definitely not, imo.

btw @Gilles thanks for the trollping, but its not a match.

@AviD ok, thanks for checking. Let's keep this in TL though

@MichaelHampton were you joking....? Having seen you around this room, I might assume you picked up on the tags here...

@Gilles 'course, if I had anything to say about it...

@AviD I've been around a while... Just because I don't have much to say doesn't mean I'm not participating!

@MichaelHampton no complaints here, but it was a joke?

@AviD Write a hashcat rule and find out!

hehe

Translation: "No, I wasn't".

I did not change my password to that word. It depends on what the definition of is is.

Seriously though, I am no expert, I just know how to listen to them. And occasionally ask a good question.

so, did I miss anything the last couple days?

Other than me answering 2 questions yesterday, I don't think so.

woot! personal record!

Haha, yes.

to be fair, its been quite a while for me, I haven't hit that in a while.

Well, you're allowed to when you reached a nice amount like yours.

meh. I dont see @ThomasPornin or @Polynomial slowing down...

Do they have to take care of a newborn?

I think @ThomasPornin has hibernating cubs.

Cuteeee

and I've never expected to use that as an excuse....

Hehe