I recently started in a role as a sysops engineer. However, I'm still missing quite a few basics, specifically regarding SSL/TLS certificates & their relation to DNS.

Here's the use case:

  • A company we deal with has their own website & domains, with their own SSL certificates. We'll call their domain I want to use here data.example.com
  • We host our own website & domains, with our own SSL certificates. We'll call our domain I want to use here ourdata.ourexample.com
  • What the company we deal with wants is that when you go to https://data.example.com, you actually get the contents of https://ourdata.ourexample.com

For this, I understand that there are two possibilities:

  1. (pretty clear to me) Create a redirect at the web server level either via nginx/apache: this implies that both domains still do have their own SSL certificates but it's just a matter of writing some lines in a config file, nothing to do with any DNS configuration.
  2. (this is where it starts getting complicated for me) Ask the company we deal with to provide us CSR information (https://en.wikipedia.org/wiki/Certificate_signing_request) so that we can generate a CSR file... from the private key that we use to generate our own SSL certicates...? Then we hand over the CSR and they pay for their own SSL certificate. They can then create a new CNAME that will redirect data.example.com. to ourdata.ourexample.com.. What I'm told is that the CSR is a kind of public key, which is why we can easily hand it over to someone else. But even if this description correctly describes the process, I'm honestly lost as to what happens where and why this is done.

Finally, something I've noticed in the case where CSR was generate from our end and the CNAME was created is that when we go to https://data.example.com, we see the content of https://ourdata.ourexample.com and the URL shown in the browser remains https://data.example.com. I'm not certain whether this is related to some web server configuration or to DNS "settings".

I hope that what I described is somewhat clear. If not, let me know and I'll try to provide more details.

Note: I've already tried to find some answers to this but while I have understood a couple of things here and there, it's still not 100% clear.

Thanks, SilentSib

  • Do you wish to show the user data.example.com or ourdata.ourexample.com ? Jan 18 '20 at 13:45
  • When I go to data.example.com, the contents of ourdata.ourexample.com should be displayed.
    – SilentSib
    Jan 18 '20 at 13:53

I assume data.example.com will be hosted on your premises and example.com does not want their clients to see that you are providing the services.

If that is the case you just need two Apache virtual hosts or two nginx virtual servers that are configured to serve the same content.

What about the certificates? It is not very complicated if you understand the concepts of public-key cryptography.

Basically (in one of the most deployed algorithms, RSA), you have two keys A and B. Data encrypted with A can be only decrypted with B (A can not decrypt it) and viceversa. You distribute one of them an call it public key, the other is kept secret and called private key. The public key is used to encrypt data only you can decrypt, the private key can also be used for signing: by encrypting a pre-agreed byte sequence (the hash of a message, e.g.) with the private key, everyone else can decrypt it and verify that you have the private key.

The other parts of the public key infrastructure are:

  • certificates: a file containing your public key, your domain name and some other data, signed by a trusted private key (whose public key is distributed and trusted by every browser). Only the domain name is on the certificate, not any other data from DNS (well, you can ask to add your IP address to the certificate if you want), so you don't have to change them when something changes.
  • CSR: almost the same as a certificate. It contains your public key, your domain name and some other data, signed by your private key (to show that you have the key). Practically Certificate Authorities use just the public key from the CSR and sometimes the domain name (if they don't take it from a HTML form).

Private keys are cheap (a couple of seconds to generate on a busy server). It is very unlikely that your client uses the same private key for data.example.com and example.com (unless they have both names on the same certificate). So:

  • If your client already has a certificate for data.example.com, ask them to send you the certificate and the corresponding private key (in a secure way). They will not be using them any more,
  • If your client does not have a certificate for data.example.com, generate a new private key and certify it. Don't use the private key for your other domains. Usually one generates a new private key, even when renewing a certificate. If you put ourdata.example.net on the same certificate, everyone will see who is providing data.example.com services.
  • You can also use Let's Encrypt if your client agrees to their terms. This way you can have a valid certificate in a matter of seconds and without additional costs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.