Client Certificates not bind to specific IP or Domain? - ssl

Question

The client certificate works if I generate the client certificate as below
openssl req -config openssl.cnf -new -nodes -subj '/C=RO/ST=Bucharest/L=Bucharest/O=XXX/emailAddress=wdw#gmail.com/CN=192.1.61.7' -keyout private/client.key -out client.csr
192.1.61.7 is the IP address of my client which uses the generated client certificate.
I want the client certificate to be used by machines from any IP addresses.
I tried CN=*.*.*.* and CN=*, neither works.
The server side is logstash tcp input filter which I can't change it.
Must the client certificate be bind to a specific IP or domains? how to generate a client certificate not binding to any IP and domain?

Answer 1

Must the client certificate be bind to a specific IP or domains?
No. But how things are handled depends on the PKI you are running. Each PKI can be different.
You can identify a user with the traditional Distinguished Name (DN) from RFC 4511, like Organization (O) and Organizational Unit (OU). Or you can identify them with an alternate name.
Here are the ways you can identify a subject by an alternate name. Its from RFC 5280, Section 4.2.1.6, Subject Alternative Name:
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
In the above, you are used to using dNSName for server certificates. Client certificates can use rfc822Name, directoryName, otherName and other GeneralName.
What you use depends on your PKI. I believe Microsoft client certificates use otherName and a custom OID. Also see How to encode a username in PKIX certificate on the Information Security Stack Exchange.
You might also want to search for Client Certificate GeneralName and do some reading.
How to generate a client certificate not binding to any IP and domain?
It depends on the tools you are using and your PKI.
At minimum, you are probably going to have to stop using the openssl command line tool without a CONF file because its too limited. You cannot set subject alternate names through command line options. Instead, you are going to have to use a CONF file.