Hot answers tagged

3

Changes to DNS aliases (CNAME) or IP addresses do not matter at all to certificate validation. All what matters is that the hostname as seen by the client (for example the name in the URL) matches the subject(s) of the certificate. This name will not change on any changes to the DNS. Often a DNS CNAME gets confused with a HTTP redirect. In the case of CNAME ...


2

[Note: In the first wording of the question, there appeared to be some pretty glaring conceptual problems, the re-wording fixed these. I am going to leave this answer here anyway in hopes that it's useful to somebody.] PKI Fundamentals I think we need to go back to basics on how Public Key Infrastructure and certificates work. I am going to shamelessly ...


1

As to the first part of your question. the answer is NO, and all who say it is forget that that also means breaking essential layers of security on the device. as to the second it is possible but highly dubious to do so. The way to do this is by buying a certificate for a domain (like localapp.example.com) and have its DNS entry point to 127.0.0.1. and ...


1

Addressing your points: Our team has looked into certificate pinning [of the document signing cert]. ... We decided against it for a couple reasons. The biggest reason is that if a key was compromised or a cert expired we'd have to re-ship our software ... We'd rather let a public CAs CRL take care of revocation for us. Yup, that makes sense. Public ...



Only top voted, non community-wiki answers of a minimum length are eligible