5

I am attempting to purchase a standard (non-EV) SSL Certificate for an internal application (Oracle Hyperion) that we have made available over our organization's WAN. The application is not accessible from the internet.

The company from whom we are attempting to purchase this cert has told us they cannot issue the cert without being able to access the application (website) and "review it".

I am curious to know if this is standard practice with SSL certs? I've not encountered this kind of issue in the past and I know I've ordered certs for non internet-facing websites before.

Improve this question
9
  • 9
    Here is a crazy thought... if your users are all on the organization's network, then perhaps you could use a self-signed certificate and manually install that certificate on each PC.
    – egray
    Dec 14, 2016 at 21:33
  • 2
    @egray Presumably the reason they are paying for a publicly-trusted CA in the first place is because they don't have the ability to / don't want the hassle of installing a cert on every client.
    – Mike Ounsworth
    Dec 14, 2016 at 21:42
  • 7
    @KnightHawk Doesn't that kinda defeat the purpose of a cert? Also, that's assuming that the server is using the cert for browser / HTTP traffic, and not some back-end server-to-server TLS thing (I'll admit I have no idea what Oracle Hyperion is or whether there is any inter-component traffic).
    – Mike Ounsworth
    Dec 14, 2016 at 22:01
  • 1
    If you need this for partner and subsidiaries then you are correct, a self signed cert is not for you. Let's Encrypt might be good as @matt nordhoff stated.
    – KnightHawk
    Dec 14, 2016 at 22:18
  • 1
    To round off the self-cert option. You should create a self-signed CA cert that is issued to all devices that need it. Then you can create - and more importantly renew - your own certs in the same way that a publicly issued cert works. I even have a script on GitHub to do that properly if anyone wants the reference. This is absolutely as secure as using a publicly issued cert as long as your private CA is kept secure. I realise this isn't the solution here though.
    – Julian Knight
    Dec 15, 2016 at 7:39

2 Answers 2

Reset to default
14

Adding to what @JulianKnight said, unfortunately the cheap bulk automated SSL vendors are only really designed to handle public-facing web servers. As part of their issuance procedure they often require you to prove you control the site by placing a file at a specified URL, or something else that they can validate in an automated way. This is largely for the convenience of the CA.

It's a perfectly valid use-case to have a publicly-trusted CA issue certs for private internal-only servers (including TLS uses other than HTTP). Nothing wrong with that, but you may need to pay a little more for the cert because the $0 - $5 certs aren't really designed to handle this. In particular, you'll need to find a CA that lets you prove ownership of the domain by some other mechanism.

Improve this answer
2
4

Unfortunately, it isn't that uncommon. You do get some strange requests from some cert vendors.

The truth is that they should only really require confirmation that you actually own the host. Some of the best processes for that are to get you to add a TXT record to your host domain's DNS entries. Some vendors also follow up with a phone call though in my experience, that really doesn't provide any additional security.

Some vendors only require a response from your designated webmaster or postmaster email account.

Improve this answer
4
  • 2
    Calling the phone number found on the website and confirming the host ensures both that you are in control of the website and are indeed requesting a certificate for that host.
    – Phil_1984_
    Dec 15, 2016 at 1:21
  • 2
    Funny story about webmaster email accounts: Windows Live in non-english zones apparently used translated versions of webmaster@, admin@, etc and just last year a Finnish man realized that webmaster@live.fi or something was available to the public, so he signed up for it. That was enough to convince an automated CA that he was Microsoft and issue him a cert for live.fi that Windows accepted. news.softpedia.com/news/…
    – Mike Ounsworth
    Dec 15, 2016 at 3:30
  • 1
    @Phil_1984_, I get confirming the host. But yesterday I was called to confirm but my number is not the one on the site and they gave me enough clues about the other info they wanted that I could look them up on the Internet anyway!
    – Julian Knight
    Dec 15, 2016 at 7:30
  • @MikeOunsworth, yes and all too many orgs don't even think about the mail rfc and the things they are meant to do like maintaining a postmaster account.
    – Julian Knight
    Dec 15, 2016 at 7:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .