As part of a project that my company is doing, we need to setup a development server.

Let's say our company's main domain is example.com

We need to be able to access the dev server through dev.example.com but unfortunately, company policy does not allow dev servers to have subdomains for the example.com

We need this due to SSO cookie issue.

We worked a way around it by using a hosts file but the problem is that we need to apply SSL.

In this case, can I register and apply a SSL with a common name 'dev.example.com'? I do have access to example.com's registered email address on WHOIS DB.

  • 6
    Did you consider using a self-signed certificate for the development environment and add it manually to the trusted certificates of the developers workstations? – Philipp Sep 12 '14 at 9:25
  • That's a good idea @Philipp, and the way to go unless the dev server needs to be externally accessible by a large group. – GdD Sep 12 '14 at 9:47
  • Well.. considering that SSL only costs like 5~9 USD it seemed like a better option to buy that than installing certificate in all the developers' machines. (Some of them are not even in the same country) – yhware Sep 12 '14 at 10:04
  • 1
    @dK3 development environments must never be exposed to the internet. The problem of SSL on a dev site is minimal, compared to the concern of exposing untested code to the open internet. You are asking for trouble. – rook Sep 12 '14 at 15:30

That answer is most likely. It depends on the verification depth (or lack of) from the issuing certificate authority.

With that being said, it sounds like you will still be breaking policy even if you find a CA that will issue a certificate based on email verification alone.

Are you willing to suffer the repercussions if/when caught?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.