I have two servers in an Active Directory domain. Both servers have apps that run in Tomcat. I'm ordering PKI certificates for these two servers.
The servers are members of the AD domain "ourInternalNetwork.com". The majority of systems on this domain are not accessible from the public Internet. These two servers will be accessible from the 'Net.
For political reasons, we have not registered "ourInternalNetwork.com" Rather, we have the domain "ExternalNetwork.com" When we go into the system properties, the servers identify themselves as "server1.ourInternalNetwork.com" and "server2.ourInternalNetwork.com". However, we want Internet-connected users to reach the servers by "server1.externalNetwork.com" and "server2.externalNetwork.com"
This requires a Subject Alternative Name, right? My understanding is that if we create CSR's with no SAN, the CSR will be for "server1.ourInternalNetwork.com", and our CA won't issue us a certificate for "server1.ExternalNetwork.com"? But if we specify a SAN, then our CA will issue a cert for both "server1.ourInternalNetwork.com" and "server1.ExternalNetwork.com".
Do I have that right?