How to apply for a free SSL (HTTPS) certificate for IP (no domain name required)

1. A brief introduction to https

HTTPS (full name: Hyper Text Transfer Protocol over Secure Socket Layer) is an HTTP channel with security as its goal. Simply put, it is a secure version of HTTP. That is, the SSL layer is added to HTTP. The security foundation of HTTPS is SSL (Secure Socket Layer).

The services provided by the SSL protocol mainly include:

Authenticate users and servers to ensure data is sent to the correct client and server
Encrypt data to prevent it from being stolen
Maintain data integrity and ensure that data is not altered during transmission

There are a lot of more detailed and professional information about https on the Internet. Here we will only give a brief introduction to give you some conceptual understanding and ultimately complete the implementation of https on the Android and server sides.

ssl certificate

2. The role of SSL certificate

An SSL certificate is a type of digital certificate, similar to an electronic copy of a driver's license, passport, or business license.

The two main functions of SSL certificates: data encryption and identity authentication.

SSL certificates comply with the SSL protocol and establish an SSL secure channel between the client browser and the Web server.

A valid, trusted SSL digital certificate includes a public key and a private key. The public key is used to encrypt information, and the private key is used to decrypt the encrypted information. Therefore, when the browser points to a secure domain, SSL will simultaneously confirm the server and the client, and create an encryption method and a unique session key. They can start a secure session that guarantees the privacy and integrity of the message.

SSL certificates can implement HTTPS encryption for websites and are suitable for various WEB projects and encrypted interfaces. SSL certificates can prevent website hijacking and protect data encrypted transmission, effectively protecting network security.

IP-type SSL certificates are mainly used for project API interfaces or ERP, OA, remote video, VPN and other request encryption and data protection, which is conducive to the security of IP transmission.

3. IP SSL Certificate

IP SSL certificates can solve the problem of HTTPS encryption requests for public IP addresses of enterprises and institutions. In any case, if the IP is hijacked or the data is stolen in the middle, using IP address SSL certificates to configure IP SSL certificates can effectively avoid such attacks. IP SSL certificates effectively guarantee the security and encryption protection of online WEB project sites of enterprises and institutions. Moreover, there are many port application scenarios under public IP, and one IP certificate can cover all of them. The speed of issuing IP SSL certificates is also very fast, and the certification can be completed in one minute. Enterprises and institutions can also apply for SSL certificates for real-name IP certificates on the same day.

IV. About Self-Signed SSL Certificates

Compared with the self-signed certificate, the signed certificate issued by the authoritative certificate authority is called a CA certificate.

The CA certificate guarantees the identity of the holder and the ownership of the public key, and the browser trusts the CA certificate.

5. Notes

IP SSL certificates are divided into single IP SSL certificates and multi-IP SSL certificates. Ordinary single IP SSL certificates can only protect one IP SSL certificate. If there are many IP addresses that need SSL certificates, then a multi-IP type SSL certificate is required. The maximum certificate can protect 250 IP addresses.

IP addresses do not support wildcards, nor do they support application in the form of IP paragraph summaries. When applying for an IP SSL certificate, you must clearly specify the independent IP that you want to specify.

IP type SSL certificates do not support EV type applications. Currently, only DV or OV IP SSL certificates are available.

To apply for an IP SSL certificate, you must use an independent public IP address, and the applicant's IP address must have port 80 or 443 open.

6. Overall process of applying for IP SSL certificate

Prepare a public IP address and submit it to Gworg online for application. The applicant's IP address must be accessible to the external WAN.
It only takes a few minutes to confirm the authentication and obtain the SSL certificate.
The IP SSL certificate includes SSL certificates with common server environment specifications, which can be directly configured into the project environment without the need for additional conversion.
When applying for an IP SSL certificate, enterprises and institutions must confirm the domain name and company name for real-name authentication review.
Currently, the efficiency of applying for IP SSL certificates is still relatively high. The fastest IP SSL certificate can be completed in one minute.

7. How to apply for an SSL certificate for a public IP

1. Manual application method

Go to ZeroSSL official website (URL:https://zerossl.com), Register an account and click on Apply for a Free SSL Certificate.
ZeroSSL

Fill in your IP address and select the length of your free SSL certificate.
ZeroSSL

Select Generate CSR automatically
CSR

Verify the domain name. ZeroSSL Free SSL Certificate provides two ways to verify the domain name. The simplest one is Web verification, but the premise is that you have to make your IP address accessible to the Web. If not, you can choose to use the domain name DNS to add a TXT record for verification.
Web Authentication

If you choose to access the website via Web, download the verification file directly, then upload it to the default Web directory of the IP address, and open the IP with your browser to ensure that you can access the verification file.
Verify the file

Finally, return to the ZeroSSL verification page and click Complete Verification.
ZeroSSL Verification

Download the certificate file. After the ZeroSSL certificate is successfully verified, you can download the certificate file. ZeroSSL SSL certificates are available in many forms, including Nginx, Apache, etc.

(II) Method of automatically generating SSL online

1. Generate URL:https://www.lddgo.net/encrypt/ssl (recommend)
Online free SSL certificate generator, online generation of SSL domain name certificates and IP certificates for learning and testing. You can use the generated certificate to publish HTTPS sites.

SSL certificate generation-instructions:

Enter the domain name or IP address to generate the corresponding domain name certificate or IP certificate. You can also generate a wildcard certificate, such as *.example.com.
Algorithm: Select an encryption algorithm. Two certificate algorithms, RSA and ECDSA, are supported. RSA algorithm is generally used.
Storage Type: When you download the certificate, it will be stored in PKCS12 format. You need to enter the storage password and certificate alias. The default certificate storage password is lddgo.net.
Download: A zip file containing four files:
cert.pem: certificate, in pem format.
private.key: private key, in pem format.
generate.cer: certificate, in cer format.
generate.P12: Certificate stored in PKCS12 format, including private key.
When you use nginx to deploy a website, you only need to use the two files cert.pem and private.key. If you need a certificate in another format, you can use a tool such as openssl to convert it.

2. Other website recommendations:
https://freessl.cn/ (recommend)
https://www.pianyissl.com/
https://certbot.eff.org/

I recommend the first one because it is so powerful. It takes about five minutes to complete. The usage process of the first generation tool is as follows:

Then enter your domain name in the address below
FreeSSL

Select one-click application and click Create
Apply for freessl

It will ask you to download a software. Just download it and click Create again after the download is complete.
Enter the software and configure the DNS resolver. Taking Tencent Cloud as an example, SecretId is required.
DNS resolution