I am aware that hostname verification is required for an SSL handshake to be successful, and is vital for security reasons (i.e. MiTM attacks). That said, AWS automatically assigns public DNS names for an EC2 instance and often times companies want to generate a certificate for a web service using a CN more pertinent to their company i.e. dev.contoso.com. And clients will access this service via dev.contoso.com.

If this is the case then, my understanding is that in an ssl handshake the EC2 would present a cert with the name dev.contoso.com but the actual server name would be something of the form ec2-XX-XXX-XX-XX.us-west-2.compute.amazonaws.com. And that would cause hostname verification to fail...right? Even if the server is signed by a CA which the client already trusts.

Is the right solution here to use SANs and simply specify the desired hostname as an alternate name in the certificate, or is there a more advisable solution. Please correct my understanding on this process if I am wrong.

  • 2
    Huh? If the clients are accessing the service via dev.contoso.com, that's the host name as far as they are concerned. They don't know or care that the server also has another name. (Edit: I suppose a client could do a reverse DNS lookup and complain if the name doesn't match, but I don't think that ever happens? I mean, it would break pretty much everything.) – Harry Johnston Oct 17 at 23:25
  • You can have many DNS names pointing to a given IP/host. The name amazon uses, is the name amazon uses. You don't have to use that out in the world. – Zoredache Oct 18 at 1:56
  • @HarryJohnston Then I think my understanding needs a little correcting then because I was under the impression that during a TLS handshake the client will check the CN (or SANs) in the certificate presented by the host and if it doesn't find anything that matches the domain in the URL then it will fail hostname verification. I thought this happened by default, per IETF standards, and in enforced by the browser....no? – Tikiyetti Oct 18 at 21:13
  • If I've understood the scenario correctly, you have asked the client to connect to dev.contoso.com. So that's the name that it will be expecting to find in the certificate. Unless I've misread the question, that's also the name that is in the certificate, so what's the problem? – Harry Johnston Oct 18 at 21:17
  • @Zoredache Hmm, so the public DNS name assigned to an EC2 instance, by AWS (as in the one I'd use to PuTTy or RDP to an EC2), can be different from the CN in the certificate presented by the web service? If I have that correct then is it because SANs can be provided in the cert? Or would SANs still not even be necessary? – Tikiyetti Oct 18 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.