SSL证书是否绑定到服务器IP地址？
我们在两个不同的物理办公地点有两个不同的 LDAP 提供商。
当我将笔记本电脑连接到一个位置并“从端口检索”（在 Websphere 6.1 中）以导入 ldap 提供程序的 SSL 证书时，我可以毫无问题地对相应的 ldap 进行身份验证。 如果我将笔记本电脑带到另一个办公室（默认情况下使用其他 ldap 提供商）并插入我的笔记本电脑，则笔记本电脑上的 WAS 将不会启动，因为它显示“未找到受信任的 SSL 证书”。
如果我再次“从端口检索”并重新导入证书，那么它会再次工作。
请注意，我的 WAS 总是尝试连接到一个 LDAP，它对另一个 LDAP 根本没有用处。
如果我返回另一个办公室，我会收到相同的错误，直到从该位置重新导入。 ldap 连接点为 ldap.example.com:636，并且可以在具有相同 FQDN 的两个位置进行 ping 操作。
但当 ping 时，它会解析为每个办公地点的不同 IP 地址。 为什么我会看到这种行为？
SSL 证书是否以某种方式绑定到特定 IP 地址？
如果是，那么我需要为每个办公地点维护一组不同的证书，对吗？
请注意，我检查过，无法调整 DNS 服务器以将主机名解析为相同的 IP 地址。
有人可以提供一些见解吗？
We have two different ldap providers in two different physical office locations.
When I connect my laptop to one location and I 'retrieve from port' (in Websphere 6.1) to import the SSL cert of the ldap provider, I can authenticate to the respective ldap with no problems. If I take my laptop to the other office (that uses the other ldap provider by default) and I plugin my laptop, my WAS on my laptop will not start because it says 'no trusted SSL cert found'.
If I 'retrieve from port' again and re import the cert then it works again.
Note that my WAS always try to connect to one ldap, it simply has no use for the other one.
If I go back to the other office I get the same error until I reimport from that location. The ldap connection point is ldap.example.com:636 and is pingable in both locations with the same FQDN.
But when pinged it resolves to a different IP address in each office location. Why do I see that behavior?
Are SSL Certs somehow bound to a specific IP address?
If yes, then I need to maintain a different set of certs for each office location, right?
Note that, there is no way to adjust the DNS servers to resolve the hostname to the same IP address, I checked.
Can someone provide some insight?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
SSL 证书绑定到一个“通用名称”，该名称通常是完全限定的域名，但可以是通配符名称（例如
*.example.com），甚至是 IP 地址，但通常不是。在您的情况下，您正在通过主机名访问 LDAP 服务器，听起来您的两个 LDAP 服务器安装了不同的 SSL 证书。 您可以查看（或下载并查看）SSL 证书的详细信息吗？ 每个 SSL 证书都有一个唯一的序列号和指纹，需要匹配。 我认为证书被拒绝，因为这些详细信息与您的证书存储中的内容不匹配。
您的解决方案是确保两个 LDAP 服务器安装了相同的 SSL 证书。
顺便说一句 - 您通常可以通过编辑本地“主机”文件来覆盖工作站上的 DNS 条目，但我不建议这样做。
SSL certificates are bound to a 'common name', which is usually a fully qualified domain name but can be a wildcard name (eg.
*.example.com) or even an IP address, but it usually isn't.In your case, you are accessing your LDAP server by a hostname and it sounds like your two LDAP servers have different SSL certificates installed. Are you able to view (or download and view) the details of the SSL certificate? Each SSL certificate will have a unique serial numbers and fingerprint which will need to match. I assume the certificate is being rejected as these details don't match with what's in your certificate store.
Your solution will be to ensure that both LDAP servers have the same SSL certificate installed.
BTW - you can normally override DNS entries on your workstation by editing a local 'hosts' file, but I wouldn't recommend this.
如果以标准方式设置，SSL 证书将绑定到主机名而不是 IP。 这就是为什么它在一个站点而不是在另一个站点上起作用的原因。
即使服务器共享相同的主机名，它们也可能拥有两个不同的证书，因此 WebSphere 将遇到证书信任问题，因为它无法识别第二个服务器上的证书，因为它与第一个服务器不同。
The SSL certificates are going to be bound to hostname rather than IP if they are setup in the standard way. Hence why it works at one site rather than the other.
Even if the servers share the same hostname they may well have two different certificates and hence WebSphere will have a certificate trust issue as it won't be able to recognise the certificate on the second server as it is different to the first.
大多数 SSL 证书都绑定到计算机的主机名而不是 IP 地址。
Most SSL certificates are bound to the hostname of the machine and not the IP address.
您可以将 IP 重定向到服务器上的安全网站：
You may redirect IP to a secure website on the server: