0

I have a sub domain for eg subdomain.maindomainA.example which is pointing to subdomain.maindomainB.example [SSL enabled]. The A record of subdomain.maindomainA.com points to the IP address of subdomain.maindomainB.com so the two subdomains are serving the same content.

Would it be possible to make subdomain.maindomainA.example SSL enabled if yes then what common name would be provided while generating CSR.

  • Even if the DNS is pointing to the same IP, you can configure the server to redirect one to the other if you want to. – Stephen Ostermiller Mar 25 at 16:52
  • First, don't use common name but use subject alternative name. Then, the name in the certificate must match the name in the URL used. In this case this means the name how the site gets accessed initially and not the name where it is redirecting to. – Steffen Ullrich Mar 25 at 17:02
  • You should be able to provide multiple domains when making the certificate. Give it both subdomain.maindomainA.com and subdomain.maindomainB.com. Configuration is going to be different depending on how you are doing these things. Are you using Apache? Nginx? You need to provide more details to get better help. – RaisinBranCrunch Mar 25 at 17:02
  • @RaisinBranCrunch I am using Nginx. – Prithviraj Mitra Mar 25 at 17:05
  • @StephenOstermiller How can I do that – Prithviraj Mitra Mar 25 at 17:15
2

If you have an HTTP redirection from one URL to another, the browser has to connect to first URL, negotiate TLS if using HTTPS, and then only get back answer from the webserver with a location header to learn the new URL.

Which means in turn that if the browser has to contact the first URL it needs to compelete the TLS handshake fully hence it needs an appropriate certificate received from this host, with the hostname in this first URL.

Then if it gets a redirect to a new HTTPS URL it will again conduct TLS handshake for this new host and hence it will need to receive (typically) another certificate with this new hostname in it.

There are various ways to handle this situation certificate wise:

  • you have two completely separate certificates, each one with one name
  • if both names have something in common (something longer than a TLD), then you may use only one "wildcard" certificate, like one for *.example.com would allow the first URL to be https://landing.example.com/ and second URL be https://finaldestination.example.com/
  • or you can also have one certificate listing both names, even if completely different, as long as you are able to prove to the CA you control both names at certificate issuance. This is using the "Subject Alternative Names" extension.
  • Thank you. I think option 3 will be more appropriate. For option 1 I think they need to put their domain name as common name? I don't have access to their domain name settings. – Prithviraj Mitra Mar 26 at 11:48
1

If you're using Nginx, you could do something like this:

server {
  listen 443 ssl http2;
  server_name www.example.com;

  include /etc/nginx/ssl-stuff.common;

  return 301 https://example.com$request_uri;
}

And

server {
  listen 443 ssl http2;
  server_name example.com;

  include /etc/nginx/ssl-stuff.common;

  root /var/www/html;
}

With ssl-stuff.common containing:

ssl_certificate /etc/letsencrypt/live/somename/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/somename/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers         HIGH:!aNULL:!MD5;

Just make sure you request both of the domains when you create the certificate.

  • That seems like a lot more work than getting a SAN certificate that covers multiple host names. They didn't mention that they were using nginx, so specific configuration for it probably won't be helpful. They also may have a hosting company and don't have root access. – Stephen Ostermiller Mar 25 at 20:18
  • @StephenOstermiller It's not really a lot of work either way. They mentioned it in the comments. Just trying to help as best I can with the little information given. – RaisinBranCrunch Mar 25 at 20:27
  • Sorry, I hadn't seen that they mentioned nginx. +1 then. – Stephen Ostermiller Mar 25 at 20:42
  • Thanks @RaisinBranCrunch. The problem is that the other sub domain is hosted by a third party and I do not have access to that sub domain which is subdomain.maindomainA.example. The A record of that sub domain points to my sub domain which is subdomain.maindomainB.com. Sorry I should have told you this before. – Prithviraj Mitra Mar 25 at 21:09
  • Except for specific reasons, you should not anymore run TLS1.0 or 1.1 – Patrick Mevzek Mar 25 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.