Forum Discussion

rache1_266651's avatar
rache1_266651
Icon for Nimbostratus rankNimbostratus
Sep 29, 2017

SSL validation with client (browser) in case of URL redirection

we have a task to redirect a URL say abc.com to on the GTM.

 

Currently we have a cname to point to , since we are using sd.com zone for doing global load balancing. The is pointing to reverse proxys which have the certificate with name "; on them.

 

so if i proceed to create a cname to point abc.com to ( cname ) will it throw certificate errors ? since the cert name is and not nor is it having the initial requestors abc.com. as a san name. I think this will fail certificate validation. Can anyone please confirm on this.

 

If i am correct, i think i should make this redirection to avoid certificate issues.

 

1) point abc.com to instead of directly pointing it to ( and since will redirect to since its related CNAME is already existing ).

 

This way the broswer will be in its request, also include a mention of and thus the certificate name will also match and validation will be successful.

 

Please correct me if am wrong.

 

Thanks Sri Charan Rache

 

BIG-IP DNS
LTM
security

1 Reply

Sort By
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Sep 30, 2017

    Hi,

     

    Certificate validation doesn’t follow dns cname.

     

    If your browser requests abc.com, certificate must include abc.com in SAN (or Subject but if SAN exists, subject is ignored, and chrome decided to make subject validation deprecated)