I am aware that hostname verification is required for an SSL handshake to be successful, and is vital for security reasons (i.e. MiTM attacks). That said, AWS automatically assigns public DNS names for an EC2 instance and often times companies want to generate a certificate for a web service using a CN more pertinent to their company i.e. dev.contoso.com. And clients will access this service via dev.contoso.com.
If this is the case then, my understanding is that in an ssl handshake the EC2 would present a cert with the name dev.contoso.com but the actual server name would be something of the form ec2-XX-XXX-XX-XX.us-west-2.compute.amazonaws.com. And that would cause hostname verification to fail...right? Even if the server is signed by a CA which the client already trusts.
Is the right solution here to use SANs and simply specify the desired hostname as an alternate name in the certificate, or is there a more advisable solution. Please correct my understanding on this process if I am wrong.