什么是有效的 SSL 证书通用名称？
我需要一个内部域名的 SSL 证书，但我尝试购买证书的所有提供商都说无效的公用名。
我只能为 .com、.co.uk 等顶级域名获取 SSL 吗？
是否有任何提供商可以向我颁发 mydomain.lan 证书（例如）？
I need an SSL certificate for an internal domain name, but all the providers I'm trying to buy a certificate from are saying invalid common name.
Can I only get an SSL for a .com, .co.uk etc top level domain?
Are there any providers that will issue me a certificate for mydomain.lan (for example)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
证书证明您确实拥有该域名。证书颁发机构无法确保您拥有某个名为
mydomain.lan的 LAN 设备，因此，他们 (CA) 不会为您的本地设备发出证书，因为您可以伪造它。另一方面，您可以生成自签名证书并将其作为根证书安装在 LAN 内的机器上。这是相当安全的，当使用浏览器、IM 客户端或其他支持 SSL 的软件通过 SSL 访问服务器时，不会导致服务器端出现有关自签名证书的警告。
Certificates prove that you do own the domain name. Certificate authority can't ensure that you own some LAN box called
mydomain.lan, therefore no, they (CAs) won't emit a certificate for your local box, because you could just fake it.On the other hand, you could generate self-signed certificate and install it as a root certificate on the boxes within your LAN. This is rather safe and won't cause warnings about self-signed certificates on the server side while accessing server via SSL using browser, IM client or other SSL-aware soft.
公开可用的域很好，任何有效的扩展都可以超出您提到的范围。 IP 地址也可以，但您需要提供提供商提供的文件，证明他们拥有或被授权使用所述 IP 地址。
内部名称不会由 CA 签名，除非是在 Exchange 的 SAN 证书之类的情况下，其中 SAN 字段中指定的域可能具有 mydomain.lan 之类的内容。我已经通过 SSL.com 完成了这项工作，所以我知道他们会颁发这样的证书。
Publicly available domains are fine, and any valid extensions are fine beyond what you mentioned. Ip addresses are fine too, but you will need to provide documentation from your provider that they own or are authorized to use said ip address.
Internal names will not be signed by CAs, except in instances like a SAN certificate for Exchange where a domain specified in the SAN field may have something like my domain.lan. I've had this done with SSL.com so I know they will issue a certificate like that.