Can I use this certificate on my commerce website?
Although there's no technical reason why you couldn't use the sslip.io SSL key and certificate for your commerce web, we strongly recommend against it: the key is publicly available; your traffic isn't secure. sslip.io's primary purpose is to assist developers who need to test against valid SSL certs, not to safeguard content.
-What is the sslip.io certificate chain? -
-The sslip.io certificate chain looks like the following:
- Note that the "root" certificate is "AddTrust's External CA Root", which issued a certificate to the "COMODO RSA Certification Authority", which in turn issued a certificate to the "COMODO RSA Domain Validation Secure Server CA" which in turn issued - our certificate, "*.sslip.io".
My webserver wants a certificate and an "intermediate certificate chain"—where do I get that?
Certain web servers (e.g. Tenable's Nessus scanner) prefer to split the chained certificate file (which has three concatenated certificates) @@ -85,19 +76,32 @@ other head content must come *after* these tags -->
Why don't you include "AddTrust External CA Root"'s root certificate in your chain?
-Certain people consider it bad taste to include the root certificate in the .pem chain. Really. And the root certificate doesn't need to be there: it's already installed in the system (and sometimes in the browser).
Why can't I use dots in my hostname? xip.io lets me use dots.
-Do I have to use the sslip.io domain? I'd rather have a valid cert for my domain.
-If you want valid SSL certificate, and you don't want to use the sslip.io domain, then you'll need to purchase a certificate for your domain. We purchased ours from Cheap SSL Shop, but use a vendor with - whom you're comfortable.
- +You can't have dots, but you can have dashes: for example, "www-sf-ca-us-10-9-9-142.sslip.io" will work with sslip.io's wildcard SSL certificate, but "www.sf.ca.us.10.9.9.142.sslip.io" will not. This is a technical limitation of wildcard certs and the manner in which browser treat them (read more here). This restricts sslip.io's usage model. For example, it won't work properly with Cloud Foundry's app domain or system domain. +
Can you make the hostnames easier to remember? I'm being force to memorize IP addresses.
+Unfortunately, no. We appreciate that "52-0-56-137.sslip.io" is not an easy-to-remember hostname, whereas + something along the lines of + "aws-server.sslip.io" would be much simpler, but we don't see any easy solution—we need to be + able to extract the IP address from the hostname in order for our DNS nameserver to reply with the proper + address when queried.
Do you have support for IPv6-style addresses?
-Not yet, but if there's enough demand for it, we might try implementing it.
+Not yet, but if there's enough demand for it we might try implementing it.
Why did you choose a 4096-bit key instead of a 2048-bit key?
We couldn't help ourselves—when it comes to keys, longer is better. In retrospect there were flaws in our thinking: certain hardware devices, e.g. YubiKeys, only support keys of length 2048 bits or less. Also, there was no technical value in making a long key—it's publicly available on GitHub, so a zero-bit key would have been equally secure.
+Do I have to use the sslip.io domain? I'd rather have a valid cert for my domain.
+If you want valid SSL certificate, and you don't want to use the sslip.io domain, then you'll need to purchase a certificate for your domain. We purchased ours from Cheap SSL Shop, but use a vendor with + whom you're comfortable.
+What is the sslip.io certificate chain? +
+The sslip.io certificate chain is the series of certificates, each signing the next, with a root certificate at the top. It looks like the following:
+ Note that the "root" certificate is "AddTrust's External CA Root", which issued a certificate to the "COMODO RSA Certification Authority", which in turn issued a certificate to the "COMODO RSA Domain Validation Secure Server CA" which in turn issued + our certificate, "*.sslip.io".
Where do I report bugs? I think I found one.
Open an issue on GitHub; we're tracking our issues there.
There's a typo/mistake on the sslip.io website.