I'm using a service (banana.com) that allows me to use my domain (orange.com) to log in.

They mention to add a CNAME record like so:

an.orange.com. 3600 IN CNAME service.banana.com.

I did that but when I access the URL, I get ( on Chrome ) an error Your connection is not private"" :

Your connection is not private

My server runs on Apache.

Why would the server have to prove that it is an.orange.com? Why is it even hitting my server in the first place? Shouldn't the address resolve to service.banana.com?

  • 2
    The way DNS eventually resolves the hostname to an IP-address by following the CNAME does not change the fact that browser uses the hostname you enter in the URL bar in all HTTP(S) requests request sent to that IP-address. And since the webserver is not configured with a certificate for an.orange.com it will fall back to using the default site with the default certificate, one for *.banana.com which is of course no good for an.orange.com – HBruijn Feb 13 at 10:11

The CNAME record declares that an.orange.com is an alias for the canonical name service.banana.com.
This means that when a client looks up some record type (eg A) at an.orange.com the response will effectively have the A record for service.banana.com instead.

In a regular application, like the web browser in your example, the application doesn't know or care that there was an indirection in the form of a CNAME record as as part of the name resolution process (which it is largely blind to the internals of), it just uses the resulting IP address.

With this in mind, when the user navigates to https://an.orange.com/ in their web browser, the browser is set on connecting to the host portion of the url (an.orange.com), it resolves this name, gets an IP address, connects, it then fully expects a valid certificate for the host from the current URL in case of HTTPS, it then sends the Host header with the host portion of the current URL (an.orange.com) as part of their request.

The is wildly different from how a web browser reacts to an HTTP redirect, where it is told to navigate to a different URL, restarting the entire navigation process with all new expectations (eg, now attempting to connect to https://service.banana.com/).

For HTTPS, this has the implication that if you want to allow users to navigate to https://an.orange.com/ you must have a valid certificate for this name.

  • So, this external service I'm using has to have a provision for me to provide a certificate for an.orange.com? Because right now, there's only a textbox where I have to enter the sub-domain (an.orange.com) that I've made a CNAME record for. – adi Feb 13 at 10:40
  • @adi Either for the user to provide a certificate or have a means of getting a valid certificate on their own (may be viable for basic DV). – Håkan Lindqvist Feb 13 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.