1

Question:

Is a certificate issued to a subdomain valid for a CNAME in the parent domain assuming a common root CA cert and SAN listing both? (I think the answer is no but I'm uncertain).

Is there a proper way for DNS to present a DNS record for the SAN in the subdomain from the parent domain perhaps? Can corp.com provide the CNAME for server.country2.corp.com via DNS without violating the SOA?

Or is it impossible to properly have a parent domain CNAME alias for a subdomain server's A record.

Current Status: Firefox (67.0), Chrome(74.0) and IE(11.0.9600) all accept url server.country2.corp.com as having a valid cert.

With the same cert, only Chrome and IE accept using CNAME serveralias.corp.com for server.country2.corp.com as having a valid cert. Firefox insists that it's not valid with SSL_ERROR_BAD_CERT_DOMAIN

Background:

  • CA at ca1.corp.com
  • My client, client.country1.corp.com
    • accepts ca1.corp.com as a trusted root.
    • Firefox has the root certs installed manually. IE and Chrome are using the windows certificate store.
  • The server is server.country2.corp.com
  • the cert is issued to server.country2.corp.com
    • contains a subject alternative name (SAN) on the cert includes:
    • the A record for server.country2.corp.com
    • CNAME serveralias.corp.com which references the DNS A record for server.country2.corp.com.
  • Certs don't have A or CNAME records. They have domain names and wildcards (*.x, not *.*.x). HTTPS clients, when they see DNS CNAME, use the IP of the A record pointed to by the CNAME, but they still use the original domain for SNI, to validate the cert and for HTTP Host header. CNAME only affects the IP address, nothing else. CNAME is kinda like editing /etc/hosts by hand - TLS SNI, cert validation and HTTP Host header are unaffected. Firefox and Chrome will need the domain used in the URL to be in the SANs of the cert presented by the server, and that code doesn't know about CNAME. – Z.T. Jun 3 at 20:03
  • So, take openssl s_client or curl --verbose, and check that cert presented for SNI with server.country2.corp.com contains SAN for server.country2.corp.com and cert presented for SNI of serveralias.corp.com contains SAN for serveralias.corp.com. Doesn't matter if it's same cert, same IP address, etc. – Z.T. Jun 3 at 20:07
  • Remember for OpenSSL versions below 1.1.1 (less than a year old, and many distros don't pick up changes immediately) commandline s_client does not send SNI by default, you must specify -servername whatever . – dave_thompson_085 Jun 4 at 0:21
  • I don't think SNI is in use. – regress Jun 4 at 3:41
  • Thank you for reminding me to s_client, I should have gone there before even asking this. TLS server extension "renegotiation info" (id=65281), len=1 is the only extension info I see. Both URLs present the same root cert and site cert. Both server.country2.corp.com and serveralias.corp.com are in the SAN. Also in the SAN are some other variants like the server without the FQDN and the CNAME hostname without the FQDN. – regress Jun 4 at 3:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.