Https for embedded devices, local addresses

Question

I am trying to add https to the embedded devices I am working on. These devices are generally assigned local ip addresses and so cannot get their own ssl certificates.

So essentially my question is how does one get a certificate for a device without a global ip address??

Assumptions:

Browsers won't trust certificates unless they've been verified by a trusted CA.

However you can only get a verified certificate for a globally unique domain.

Those darn customers insist on local ip addresses.

Similar question here

---

Hypothesis A:

1. Get a certificate for main company website
2. Copy that cert. + private key to all devices
3. User connects to device
4. Device sends cert. to user
5. User sees cert. is trusted (ignores that it's not for this server??)
6. User encrypts http using public key in cert
7. Device uses private key

Results:

1. Browser complains about name mismatch
2. Customers have access to each others private key
3. Not very secure

---

Hypothesis B:

1. Get a certificate for main company website FOR EACH DEVICE
2. Copy a cert. + private key to each device
3. User connects to device
4. Device sends cert. to user
5. User sees cert. is trusted (ignores that it's not for this server??)
6. User encrypts http using public key in cert
7. Device uses private key

Results:

1. Browser complains about name mismatch
2. Secure

---

Hypothesis C:

1. Create self-signed cert for each device
2. Copy a cert. + private key to device
3. User connects to device
4. Device sends cert. to user
5. Firefox has a canary
6. User encrypts http using public key in cert
7. Device uses private key

Results:

1. Browser complains about self-signed cert
2. Self-signed cert could be man-in-middle attack

Answer 1

If the customer insists on local IP connectivity you don't even need to leverage a worldwide Public Key Infrastructure by reaching out to "known" Certificate Authorities.

Just set up your own local PKI with its own local CA and distribute your CA's certificate to all the clients. Then use that CA to issue certificates to the devices and they'll be trusted by the clients.

Answer 2

Is getting a wildcard certificate and using it as a subdomain for your devices an option?

As long as your devices are on DNS locally, IP addresses should not matter.