I recently started in a role as a sysops engineer. However, I'm still missing quite a few basics, specifically regarding SSL/TLS certificates & their relation to DNS.
Here's the use case:
- A company we deal with has their own website & domains, with their own SSL certificates. We'll call their domain I want to use here data.example.com
- We host our own website & domains, with our own SSL certificates. We'll call our domain I want to use here ourdata.ourexample.com
- What the company we deal with wants is that when you go to https://data.example.com, you actually get the contents of https://ourdata.ourexample.com
For this, I understand that there are two possibilities:
- (pretty clear to me) Create a redirect at the web server level either via nginx/apache: this implies that both domains still do have their own SSL certificates but it's just a matter of writing some lines in a config file, nothing to do with any DNS configuration.
- (this is where it starts getting complicated for me) Ask the company we deal with to provide us CSR information (https://en.wikipedia.org/wiki/Certificate_signing_request) so that we can generate a CSR file... from the private key that we use to generate our own SSL certicates...? Then we hand over the CSR and they pay for their own SSL certificate. They can then create a new CNAME that will redirect data.example.com. to ourdata.ourexample.com.. What I'm told is that the CSR is a kind of public key, which is why we can easily hand it over to someone else. But even if this description correctly describes the process, I'm honestly lost as to what happens where and why this is done.
Finally, something I've noticed in the case where CSR was generate from our end and the CNAME was created is that when we go to https://data.example.com, we see the content of https://ourdata.ourexample.com and the URL shown in the browser remains https://data.example.com. I'm not certain whether this is related to some web server configuration or to DNS "settings".
I hope that what I described is somewhat clear. If not, let me know and I'll try to provide more details.
Note: I've already tried to find some answers to this but while I have understood a couple of things here and there, it's still not 100% clear.