We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by a hosting provider. It's just an informational site with no login\commerce function so currently just runs over HTTP. They will continue with this.
They now want to implement a web application that must be hosted on-premises under IIS. They will be communicating with this web application using an Android app on tablets, via an domain name and port. The traffic for this must be over HTTPS.
The customer's premises has a static external IP.
So in overview abc123.ie is a website hosted by their hosting provider. They need to also have an on-premises web service secured by SSL.
My understanding of how this can be achieved is as follows.
- Customer obtains a new subdomain from the hosting provider, say mobile.abc123.ie.
- Customer generates a CSR on the on-premises server and obtains a domain-validated SSL cert from the hosting provider for mobile.abc123.ie.
- Hosting provider sets things up so that traffic for mobile.abc123.ie is forwarded to the external IP of the customer's premises.
- Customer's IT vendor configures on-premises firewalls for traffic on port 443 to be forwarded to the internal name or IP of the IIS server.
- We create a HTTPS binding for the web service in IIS and install the cert.
- Android devices hit https://mobile.abc123.ie to access the web service.
Does this sound sane?