Bright ideas on working around CABF restrictions on SSL certificates?

[DrPerceptron]

Phasing out Intranet Names and IP Addresses in SSLs | Go Daddy Help | GoDaddy Support

 

Anyone have any?

 

Short reason is I need to sign some web hosts internally for access on our devices (no problem), but also phones/tablets/laptops that students/staff bring in that aren't part of our network, but it seems that now I can't use a GoDaddy certificate to do this so I'm stuck with a (currently) useless certificate.

 

Obviously I *could* change everything to use our school domain name internally as well, but that seems... unnecessarily complicated and annoying.

[glennda]

TBH it is going down the need to use the FQDN for everything, the idea being that access can be seemless whether internal or external (not having to remember different addresses for things like OWA etc).

 

The main big thing that I have had to start getting my clients to do is configure Exchange to use an external FQDN i.e mail.fulldomain.com rather than server.domain.local.

 

This also actually helps when starting to bring in things like load balances are systems expand/higher availability is require.

[sukh]

For Exchange use split DNS.

[DrPerceptron]

It's not for Exchange. Exchange is fine for another year or two... and then hopefully going up into O365.

 

This would be for smoothwall and a pair of internal only web servers. So all 3 are obviously currently on our .local domain. I did try adding our FQDN to DNS and then adding a new host record that points to the boxes locally, but it doesn't seem to have changed anything.

Edited November 27, 2013 by DrPerceptron

[localzuk]

Unless you want to migrate to using a real FQDN internally, the only other option is split DNS.

 

We use split DNS for our VLE/website here, works fine.