Have Geek Brain

Is DNS redirection a solution for SSL certificate errors on unexpected subdomains?

(similar to this question , but with a different twist).

IIS 6, if applicable.

So we got a certificate signed to www.foo.com, and of course, HTTPS requests for foo.com certificate warnings. Some questions:

  • Will the DNS CNAME for foo.com queries point to www.foo.com fix the problem?
  • If not, what's the best best method? I have seen wildcard certificates and add SubjectAlternativeNames to the certificate. Are there pros and cons for each, or are they both the same?
  • Even if adding the DNS CNAME would work, is this the "correct" method?
+1


a source to share


1 answer


DNS CNAME won't work: The browser checks the hostname given in the url against the certificate and is not interested in whether the hostname is resolved by following the CNAME elsewhere.



I'm not sure if CAs issue wildcard certificates, or what support for them. If the CA is willing to do this, creating a certificate with foo.com as SubjectAlternativeName is an option. I think browser support for this is widespread right now.

+2


a source






More articles:


All Articles