doesn't contain any IP SANs

[jwtalbot]

Hi,

I'm getting the following error when trying to connect...

(A: Names have been changed to protect the innocent.)

:~/go/bin$ ./watchblob 1.1.1.1
Username: admin
Password:
Requesting challenge from 1.1.1.1 as user admin
Did not receive challenge from server
Response: { 0 0 }
Error: Get https://1.1.1.1/?action=sslvpn_logon&fw_domain=Firebox-DB&fw_logon_type=logon&fw_password=piswud_username=admin&style=fw_logon_progress.xsl: x509: cannot validate certificate for 1.1.1.1 because it doesn't contain any IP SANs

Any idea what might be the problem?

Ta

[tazjin]

That means the certificate is invalid. It's very uncommon for valid TLS certificates to be issued for an IP address (unless it's an internal CA), but the error message actually says that the presented certificate doesn't contain any subject entries for IP addresses.

You probably have to connect to some hostname instead of the IP. This tool itself has no option for disabling certificate checks, but you could probably modify the source to disable the certificate verification.

[jwtalbot]

Ah.. Super.. Thanks for that.