How ssl certificates are handled in CNAME mapped domains?

user_11680998 0
Viewed 3330

I observed a site example.com has a cname mapping with mysite.com. Both example.com and mysite.com have ssl certificates.

Correct if I am wrong?

When a browser tries to connect https://example.com it checks DNS and finds it has cname mapping with mysite.com and connect to mysite.com web server directly.

When I observed browser it has ssl certificate for example.com domain. I am facing problem in understanding this case.

If request did not go to example.com web server how could browser get ssl certificate of example.com or my cname mapping understanding is wrong?

or example.com private and public keys are shared with mysite.com webserver ?

cname ssl
2 Answers

DNS and TLS operate completely independent of each other.

TLS is used, among other things like encryption, to verify the identity of a server against its FQDN (Fully qualified domain name). This is done by checking whether the server in question is able to present a certificate, containing the FQDN, signed by a trusted certification authority (CA).

DNS is used to resolve host names to IP addresses, in order to establish network connections (like TCP connections) on a lower layer. How this resolution takes place is completely transparent to other components, like TLS. It does not matter whether the name resolution involves A, AAAA, or the mentioned CNAME record - in our context the input is always a single hostname, the output is always one (or more) IP addresses. Intermediate results, like CNAME mappings, are essentially discarded once name resolution is done.

This means that the TLS client always uses the FQDN initially requested by the user, regardless of any CNAME mappings, to verify the certificate. How to present a valid certificate is up to the server - sticking to your example, the server behind FQDN mysite.com will have to present a certificate valid for example.com in order for the client to accept it. How the private/public key of this certificate is generated, and whether it is shared with other certificates or servers, does not matter.

user_28998850

We would have to explicitly attach the SSL certificates of both the domains to the webserver/load balancer for both the domains to support HTTPS.

user_49402780
Related