Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain).
Is there a proper way for DNS to present a DNS record for the SAN in the subdomain from the parent domain perhaps? Can corp.com provide the CNAME for server.country2.corp.com via DNS without violating the SOA?
Or is it impossible to properly have a parent domain CNAME alias for a subdomain server's A record.
Current Status: Firefox (67.0), Chrome(74.0) and IE(11.0.9600) all accept url server.country2.corp.com as having a valid cert.
With the same cert, only Chrome and IE accept using CNAME serveralias.corp.com for server.country2.corp.com as having a valid cert. Firefox insists that it's not valid with SSL_ERROR_BAD_CERT_DOMAIN
- CA at ca1.corp.com
- My client, client.country1.corp.com
- accepts ca1.corp.com as a trusted root.
- Firefox has the root certs installed manually. IE and Chrome are using the windows certificate store.
- The server is server.country2.corp.com
- the cert is issued to server.country2.corp.com
- contains a subject alternative name (SAN) on the cert includes:
- the A record for server.country2.corp.com
- CNAME serveralias.corp.com which references the DNS A record for server.country2.corp.com.