2

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server.

We have a few contractors accessing this site from outside the network and while they can do so just fine via IP address, their browser properly flags the SSL cert as being invalid and forces them to HTTP.

I want to ask them to edit their HOSTS file and add a record for this site. If they do that, will their browsers properly acknowledge the site's SSL cert? Note that the cert is issued by DigiCert so there won't be a chain of trust issue - the only weak link was the DNS registration.

(We're setting up VPN access for these users but it takes a few weeks to go through internal red tape so this is a short-term solution.)

6

Yes, it will work. SSL/TLS don't care about name resolution mechanisms and network routing details. The only requirements are:

  • TLS certificate itself is valid (i.e. time valid, trusted, not revoked, usages are correct, blah-blah-blah as per RFC 5280 §6).
  • TLS certificate's SAN extension contains an entry that matches the name entered in the web browser's address bar.
  • Fantastic, thanks for the citations and confirmation! – Brian R Jan 21 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.