Here is my current architecture: I have a simple site hosted in the cloud that needs to be served from my company. Thus, mysite.com has a CNAME redirect to 1234.cloud.com. I understand that the SSL certificate needs to be created for mysite.com.

Here are my questions:

a) how does the CNAME redirect work when fetching content? does DNS resolve the cloud IP address and allow just one HTTP connection to the cloud or is the HTTP connection sent to my server and then relayed to the cloud? which server presents the SSL cert for mysite.com? I believe that I need to configure a local server to offer the SSL certificate because DNS alone would not suffice, but I am not sure on the architecture.

b) how can I ensure that the communication between my server and the cloud is also encrypted? do I need to configure client/server SSL between the two servers?

  • What do you mean by "which server"? There's only one server in your architecture. – David Schwartz Feb 1 '16 at 23:30
  • Note that this scheme will fail anyway, because you cannot have a CNAME at the root of a domain (in your case, mysite.com). – MadHatter Feb 2 '16 at 17:36
  • @DavidSchwartz I did not know that I do not need to use a server on prem; MadHatter - good point, the true DNS name is not at the root domain – Johnny D Feb 3 '16 at 18:44

I think you're confusing terms a little bit. A CNAME is not a redirect per se. It's just a record type in DNS, also known as a DNS alias. The DNS protocol is ultimately about mapping names to IP addresses. The most common record type is a "A" record which is a one-way mapping of Name to IP. The CNAME record instead is a one way mapping of Name1 to Name2.

In your case, the CNAME record tells clients requesting the IP "mysite.com" to instead request the IP for "1234.cloud.com". So the client then requests the IP for 1234.cloud.com, gets its IP ( for example) and continues connecting. This is all done on the network stack of the client. The web browser doesn't know anything about this exchange. All it knows is that the network stack says "mysite.com" maps to "".

Your cloud server is the one that will host both the site and the SSL certificate (unless you have a load balancer in front of the cloud server). No servers from your company are involved except the DNS servers that are authoritative for your company's DNS zone, mysite.com.

The only way to ensure the communication is encrypted between clients and your cloud server is to disable non-HTTPS requests on the cloud server.

  • ok. in this case, i will need to give my SSL cert to the cloud provider. it all makes sense now. – Johnny D Feb 2 '16 at 16:00
  • And the secret key as well. They cannot use the certificate without it. – MadHatter Feb 2 '16 at 17:37
  • Thanks, It make much sense now. One more question: He needs to put the SSL cert of 'mysite.com' to his cloud web server, and the web server need to set 'server_name' to 'mysite.com', not '1234.cloud.com', is that correct? – user2875289 May 28 at 4:38
  • Yes, the certificate goes on the cloud server. But the web server configuration is highly dependent on which web server is running there. – Ryan Bolger May 28 at 15:18

You have to understand that DNS resolving is totally separated from any HTTPS dialogue. Your system will do a DNS request to have an IP address from a DNS name. The CNAME is just an alias to another record in the DNS registry. But in the end you have an IP adddress. You can also add some record to your /etc/hosts file.

Once your browser have an IP address it can connect to the server, it initiate an SSL or TLS session. The server send a certificate to your browser who's check it correspond to the name it requested.

Usually the DNS points to the cloud, to the content delivery network. The CDN then call back your server for uncached elements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.