How would you test a new, individual SSL certificate (i.e., not a wildcard) is working properly?

Question

I am running a web server in AWS and recently purchased an SSL cert to encrypt traffic, let's say for example.com. Since example.com is running in production, how would I actually test the cert is working properly? I cannot test it with staging.example.com because it's not a wildcard cert. I don't want to just install it in case something goes wrong -- I'd like to test first.

The only thing I could come up with is creating a new VPC, spinning up a new server and creating a privately hosted DNS. I could point example.com to the private IP of the server in the internal DNS zone to see if everything loads correctly. This seems like a lot of work to test an SSL cert. Am I missing something? There has to be an easier way?

Answer 1

One way to do it is to spoof your DNS request on the computer you are testing from.

Each web-browser asks for domain name resolution when trying to access prod.example.com. On Linux you can specifically match prod.example.com to your staging computer IP address in the /etc/hosts file. On Windows, you should look for the same file but in c:\Windows\System32\drivers\etc. When you have the right instruction in there, any call to prod.example.com will direct to the staging computer instead.

Now all you have to do is configure the web-server on the staging computer with a virtual host that matches prod.example.com with the SSL/TLS certificates directives and you should be able to test it properly.

Answer 2

I assume right now your site is serving only http. The simplest way is you can install the cert and configure your web server to serve both http and https. All existing traffic will continue to use http, but you as the tester can use https. Once you've confirmed it's working, then you can configure your site to use only https.

Warning: if you are serving other https sites from the same server, you could possibly mess the other sites up if you don't configure the cert properly, especially if you are installing multiple certs on a shared IP address.

If you're worried that someone will try to use https out of the blue (since you probably don't have https links to your site yet) AND your cert may not be the way you want it, then it's probably worth taking the time to go with M'vy's suggestion by tweaking your host file and setting up a staging environment that accepts the true domain's host header as valid.