# Design Launcher Error for SSL **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [December 10, 2020, 10:58am UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380 "2020-12-10T10:58:19Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![nizamuddin.m](https://avatars.discourse-cdn.com/v4/letter/n/65b543/32.png) [@nizamuddin.m](https://forum.inductiveautomation.com/u/nizamuddin.m)\ **Post date:** [December 10, 2020, 10:58am UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/1 "2020-12-10T10:58:19Z")
When I am Launching the ignition designer after configuring the SSL configuration with a self-signed certificate there seems to be some error after I trust the certificate ![Pic_1](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/0/80535e7a31b7979977b409209f5c19115c0270df.png) ![Pic_2](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/0/903756b23cdb3ec57cb633afbbf98dbb4e97100c.png) ![Pic_3](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/b/bb44c443143222d3a1c7decdd7d0cf99aec197a3.png) Am i missing some steps or… ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 10, 2020, 12:37pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/2 "2020-12-10T12:37:48Z")
Once you enable SSL you have to start accessing the Gateway via a URL with a hostname or IP address that is listed in the certificate. That usually means you can’t use “localhost” any more. ---
**Author:** ![nizamuddin.m](https://avatars.discourse-cdn.com/v4/letter/n/65b543/32.png) [@nizamuddin.m](https://forum.inductiveautomation.com/u/nizamuddin.m)\ **Post date:** [December 10, 2020, 12:42pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/3 "2020-12-10T12:42:55Z")
I have tried with the IP of my system but it seems I am arriving at the same result - Certificate is invalid ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 10, 2020, 1:12pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/4 "2020-12-10T13:12:15Z")
Can you share the certificate or its details? Does the hostname or IP appear in the Subject Alternative Names section of the certificate? ---
**Author:** ![nizamuddin.m](https://avatars.discourse-cdn.com/v4/letter/n/65b543/32.png) [@nizamuddin.m](https://forum.inductiveautomation.com/u/nizamuddin.m)\ **Post date:** [December 10, 2020, 1:23pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/5 "2020-12-10T13:23:34Z")
![Pic_5](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/2/1249d79e31b58778e4a42e923cf7a85a47a92f8d.png) The hostname or IP does not appear in the certificate. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 10, 2020, 1:28pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/6 "2020-12-10T13:28:05Z")
I’m not sure if that page ever shows the DNS/IP entires. When you generated the certificate did you add your gateway’s hostname and IP while setting all the other details? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [December 10, 2020, 1:35pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/7 "2020-12-10T13:35:40Z")
> [@nizamuddin.m](#): > > The hostname or IP does not appear in the certificate. In case it isn't clear, the address (hostname or IP) you visit with your browser _ **must** _ be in the certificate, as the common name or in the list of subject alternative names. That is what tells the browser it is visiting a legit site. Your current cert will work (on port 443) if you add an entry to /etc/hosts for "ignition" pointing at your local IP. Then visit `https://ignition/`. ---
**Author:** ![chasondeshotel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/chasondeshotel/32/20032_2.png) [@chasondeshotel](https://forum.inductiveautomation.com/u/chasondeshotel)\ **Post date:** [December 10, 2020, 3:15pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/8 "2020-12-10T15:15:34Z")
Using hostname as the common name was deprecated in 2000, please don’t do this. Use SAN [https://frasertweedale.github.io/blog-redhat/posts/2017-07-11-cn-deprecation.html](https://frasertweedale.github.io/blog-redhat/posts/2017-07-11-cn-deprecation.html) ---
**Author:** ![satya.chaturvedi](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@satya.chaturvedi](https://forum.inductiveautomation.com/u/satya.chaturvedi)\ **Post date:** [July 18, 2024, 7:09pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/9 "2024-07-18T19:09:14Z")
Hello @Kevin.Herron , I've created the CSR using server hostname and imported the signed certificate in Ignition (It's working). If I am trying to open designer session with [https://IP:8088](https://IP:8088), it is showing certificate as invalid but working fine with [https://hostname:8088](https://hostname:8088). Your thoughts ? ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [July 18, 2024, 7:14pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/10 "2024-07-18T19:14:03Z")
When creating certificates, you can also specify an IP address in addition to a hostname. If you want to access with both IP and hostname, you'll have to provide both as part of the CSR. ---
**Author:** ![satya.chaturvedi](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@satya.chaturvedi](https://forum.inductiveautomation.com/u/satya.chaturvedi)\ **Post date:** [July 18, 2024, 7:18pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/11 "2024-07-18T19:18:53Z")
I tried to contact my CA earlier and as per them, certificates don't use IPs. ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [July 18, 2024, 7:25pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/12 "2024-07-18T19:25:53Z")
They're lying to you. You can specify an IP as a SAN (Subject Alternative Name) just like if your common name is `mycompany.com` you can also specify `www.mycompany.com` as a SAN no different than `192.168.1.100` or any other IP address. The other question I'll ask is if this is an internal Ignition gateway, why use an external CA? If it is externally exposed, make sure you've got everything secured properly. I like putting a reverse proxy in front of any publically exposed Ignition instances (or any publically exposed service for that matter), then do my SSL/TLS offloading there. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 18, 2024, 8:12pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/13 "2024-07-18T20:12:43Z")
It's not common to include IPs, and if they are included the public CAs will not allow you to use IPs from the private/reserved range, only public. There's not really any reason to do this. If your gateway is internet-facing then access it at the hostname. Internal CAs (run by your company IT department, for internal use) can do whatever they want. ---
**Author:** ![Sam\_Sheen](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@Sam\_Sheen](https://forum.inductiveautomation.com/u/Sam_Sheen)\ **Post date:** [January 1, 2025, 12:38pm UTC](https://forum.inductiveautomation.com/t/design-launcher-error-for-ssl/41380/14 "2025-01-01T12:38:43Z")
I found a way can avoid this problem in Self-signed Certificate. You can set a host table that add IP and domain name for Self-signed Certificate or not set domain name in DNS. The host table is located at (C:\Windows\System32\drivers\etc\hosts) in MS window. For example IP, domain name setting in the hosts: 123.456.789.101 [power.dafachai.com](http://power.dafachai.com) After you add the IP and domain name, you can add a new designer by domain name (the domain name need same as hosts file domain name.). ![2025-01-01_20-13-24](https://us1.discourse-cdn.com/inductiveautomation/original/3X/a/0/a0367b3d1608fd3f9b778c68ef0e64fd33d976f0.jpeg)