2

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server.

We have a few contractors accessing this site from outside the network and while they can do so just fine via IP address, their browser properly flags the SSL cert as being invalid and forces them to HTTP.

I want to ask them to edit their HOSTS file and add a record for this site. If they do that, will their browsers properly acknowledge the site's SSL cert? Note that the cert is issued by DigiCert so there won't be a chain of trust issue - the only weak link was the DNS registration.

(We're setting up VPN access for these users but it takes a few weeks to go through internal red tape so this is a short-term solution.)

Improve this question

1 Answer 1

Reset to default
6

Yes, it will work. SSL/TLS don't care about name resolution mechanisms and network routing details. The only requirements are:

  • TLS certificate itself is valid (i.e. time valid, trusted, not revoked, usages are correct, blah-blah-blah as per RFC 5280 §6).
  • TLS certificate's SAN extension contains an entry that matches the name entered in the web browser's address bar.
Improve this answer
1
  • Fantastic, thanks for the citations and confirmation!
    – Brian R
    Commented Jan 21, 2019 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .