certificate with more than one IP SAN extensions

Question

I’m using a Java web service client, which connects to a web service via HTTPS. The machine on the server side, has more than one IP address, and I would like to reach this web service through any of its IPs. The client is only able to reach the server through IP based URLs, not DNS resolvable host names.

Since the WS client performs the verification of the certificate identity based on the IP SAN extension that was established while building the certificate through the Java keytool, I wonder if it’s possible to build a certificate enumerating more than one IP SAN extensions? So far I could only establish one IP per certificate, but then, when I try to reach the WS through any other IP (a.b.c.d), I get an error stating that the certificate wasn’t made with that IP:

java.security.cert.CertificateException: No subject alternative names matching IP address a.b.c.d found

If this is not possible, how do you suggest me to circumvent this issue?

Thanks

Answer 1

Already found how to do it... and sorry to bother you guys with this dumb question... easy:

san=ip:a.b.c.d,ip:e.f.g.h

Thanks,

Ric.