1

We host several secure web applications for customers.

The customer would set up a CNAME alias to map their subdomain to our subdomain

eg. customer HTTPS URL app.customersite.com/App maps to our HTTPS URL customer.hostingserver.com/App

The customer allows us to host their SSL key & certificate which has a common name of app.customersite.com.

However, historically, the customer also has access to the customer.hostingserver.com URL. But if they access this URL, the SSL certificate is not trusted as the domain name does not match.

They have asked us to redirect customer.hostingvendor.com back to app.customersite.com somehow so both URLs would accept the SSL certificate - but surely this would set up a circular link?

Is there any way of having both these URLs working - or do we just need to convince the customer not to try and access our URL directly?

Many Thanks

3
  • A redirect wouldn't help; the SSL negotiation happens before the redirect happens. You need to have SSL certificates matching the hostname the client is using.
    – Jenny D
    Apr 3, 2017 at 16:07
  • OK - thank you - I thought that would be the case. We need to convince our customers to stop using the link to our domain and use their own one. Perhaps a solution is to delete our sub domain, and generate a new one that that their end users don't know about. Then they'll need to go through the CNAME alias.
    – cgvel
    Apr 4, 2017 at 9:01
  • Or you make SSL certificates that include your domain as a Subject Alternate Name.
    – Jenny D
    Apr 4, 2017 at 11:00

1 Answer 1

4

In short: each URL will need to be served using a certificate appropriate for the name in use.

This could either be a multi-domain SAN cert used for both, or two separate certificates.

1
  • OK - thanks for confirming this. We don't really want to present a certificate with our domain in - they should be using the customer's certificate with just their domain in. I think a bit of re-education is needed - or as I commented above, we'll change our sub-domain and get them to change the alias so that end users won't be able to connect on the old URL they have. Thank you for your time.
    – cgvel
    Apr 4, 2017 at 9:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .