This seems like it should work, but PKI is complicated and I'd like to ask people who can give an authoritative answer.
I am the network engineer for a company; for sake of argument we'll call our domain
IP:192.0.2.1(reverse-maps to radius01.thatcompany.com)
IP:192.0.2.2(reverse-maps to radius02.thatcompany.com)
If life was simple, I would just buy the corresponding SSL cert and be done with it. However...
- I need a wildcard cert Note 2; those are roughly 50% more expensive than a normal cert (Comodo calls this a Unified Communications cert).
- Since we're spending so much, my boss wants to re-use whatever cert I buy to chain trust back to Comodo for a local thatcompany.com Windows AD local root CA, which is yet to be built. Assume the DNS name for that server is pki01.thatcompany.com.
The problem is I've already given Comodo the CSR, and that CSR doesn't have pki01.thatcompany.com in the SAN. The decision to commit to a local root CA was made after I deployed the Cisco ISE server, and I'd like to understand whether it's worth contacting Comodo to make them issue the UC Certificate against an updated CSR.
If I buy the aforementioned Comodo Unified Communications wildcard certificate, is there any good reason to put the future Windows AD local root CA DNS and IP in the SAN field of the UC Certificate? Is there any other reason that we couldn't reuse this Comodo UC Wildcard Certificate to build a Windows local root CA?
Note 1: Cisco recommends that you put both your RADIUS server's explicit IP and DNS name in the SAN field.
Note 2 :
Cisco recommends that you pay for a wildcard cert (i.e. put
DNS:*.thatcompany.com in the SAN) because some EAP supplicants are broken (ref CiscoLive BRKSEC-3698 video by Aaron Woland). However, Comodo won't issue trial wildcard certs.