0

I have an account with a shared email hosting service (e.g mailcheap) and the the webmail URL is hence https://xxx.mailcheap.co. This webmail has HTTPS.

Now I created CNAME records on my domain to point https://webmail.mydomain.com to https://xxx.mailcheap.co. However, when visiting the webmail through this route, the SSL is broken with a loud in-your-face warning i.e

"Your connection is not private Attackers might be trying to steal your information from...".

I take it because the SSL certificate on the email host's webmail does not cover mydomain.com.

Besides putting up a redirect to send webmail.mydomain.com to xxx.mailcheap.co, is there any other way to prevent that "Your connection is not Private" warning?

  • The domain in mailcheap's certificate does not match the domain that you are masking using DNS. You want to hide the fact that you are using another website by using your domain as a cover. – schroeder Jul 23 '18 at 14:29
  • You should first checkout whether mailcheap allow you to "use your own domain and SSL certificate". If there is such service, mailcheap will add your domain name to their DNS and use rewrite and SNI to show your own certificate. – mootmoot Jul 23 '18 at 15:11
1

I take it because the SSL certificate on the email host's webmail does not cover mydomain.com.

This is correct. To cite from What SSL certificate do I need?: "DNS settings like same IP address or alias (CNAME) do not matter at all, all that matters is the name given in the URL.". And since the name you use in the URL is not covered by the certificate you get the validation problem.

... is there any other way to prevent that "Your connection is not Private" warning?

Since you make sure that the URL matches the certificate you need to either change the URL or the certificate. The first can be done with a HTTP(S) redirect as you've already noticed. For the second some service providers might let you setup your own certificate. If this is not possible you might try to setup your own server with your own domain and proxy all traffic to the original web application. Note that this might not work with all applications, i.e. some might have the expected name hard coded somewhere in the application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.