I have three servers: development, staging and production. I use dev as a messy environment on which I write my code. Production is my clean, sparkly, shiny tidy web server. When pushing a new version live I clone my production server and set it up as staging. On staging I edit all my database data and make sure the whole thing is running nicely before cloning my staging server to production. This may not be the best way to do it.

The issue I am hitting is that my production server has a wildcard SSL sertificate which, when I clone the server to staging, breaks. I can't test pages and I just get SSL certificate errors on staging. I am accessing staging through a static IP address, which I assume is the problem - the domain name doesn't match.

Is there a way to temporarily disable the SSL on the server so I can easily re-enable it once cloned back to prod?


What we do is use a fake domain with a self-signed certificate. So www.example.com becomes www.example.com.test (use a local DNS server or HOSTS file to make it resolve properly). The .test extension is a reserved extension so you'll never have a collision with a real domain name. Your browser will complain about this, but Firefox lets you store an exception for the fake domain and Chrome will let you go there anyways once you've confirmed you're sure.

  • So you can leave the self-signed cert on the server when you clone it to live? I guess as it's resolving to a different domain it will simply ignore the .test domain and read the real domain name cert? It just picks the cert according to the domain name? – Abraham Brookes Apr 23 '19 at 3:59
  • We deploy through version control and use Chef to configure our live environment. We don't clone servers, so YMMV – Machavity Apr 23 '19 at 12:07
  • @AbrahamBrookes "it will simply ignore the .test domain and read the real domain name cert" No. When a browser connects it expects to get served a certificate that covers the exact hostname it connects to (or having a wildcard covering the name; a self certificate on *.test will probably get rejected by the browser but it is at the intersection of two rules, so it might be worthwhile to double check that point) – Patrick Mevzek Apr 23 '19 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.