SSL Certificates and internal hostnames

[Guest Guest]

I need to by a wildcard cert so that we can publish a few servers through MS TMG on a single IP. I've never actually delt with certificates before other than self signed ones.

 

We have a MS 2008 RDweb server called remote.internaldomain.internal (as it must be joined to the domain) which will have an external name of remote.externaldomain.com, and a debian/apache VLE/Moodle server called by its external name both internally and externally of vle.externaldomain.com.

 

Will having the RDweb server with an internal hostname upset anything certificate wise? When I come to import the certificate on the 2 servers will it work? Will IIS turn round and say "this certificate isnt for my hostname"?

 

 

Cheers

Edited October 20, 2010 by Guest

[Guest Guest]

Bumpy bump

[robk]

I don`t KNOW this, but isn`t a wildcard cert designed for the situation of *.domain.tld I suspect that the internal domain name could be an issue. Can you proxy the vle content on the TMG box and therefore use an external SSL dns name?

 

You could then if needed use a self signed ssl cert for internal clients.

[Guest Guest]

I cant see the VLE being a problem as it is already named by its external address, plus you can name your web server to whatever you want in apache. Can you do this in IIS? I cant seem to find an option to do it. Bloody MS GUI crap, give me a plain text config file any day!

 

Interally I dont really care tbh, infact i dont think ive even changed the link from http to https for the VLE.

[Guest Guest]

Bump bum

[penfold_99]

I need to by a wildcard cert so that we can publish a few servers through MS TMG on a single IP. I've never actually delt with certificates before other than self signed ones.

 

We have a MS 2008 RDweb server called remote.internaldomain.internal (as it must be joined to the domain) which will have an external name of remote.externaldomain.com, and a debian/apache VLE/Moodle server called by its external name both internally and externally of vle.externaldomain.com.

 

Will having the RDweb server with an internal hostname upset anything certificate wise? When I come to import the certificate on the 2 servers will it work? Will IIS turn round and say "this certificate isnt for my hostname"?

 

 

Cheers

 

The internal name of the RDweb server will break the certificate chain.

 

The way we overcame it was

• Install the wildcard SSL certificate on the RDWeb Sever
  
• Get the RDWeb Server to use the certificate
  
• Create an A record for remote.externaldomain.com with the IP of the RDWeb server
  
• Edit the TMG Rule for RDWeb and when it asks for the computer name or IP to resolve enter remote.externaldomain.com
  

 

This will keep the certificate chain intact.

[Guest Guest]

The internal name of the RDweb server will break the certificate chain.

 

The way we overcame it was

• Install the wildcard SSL certificate on the RDWeb Sever
  
• Get the RDWeb Server to use the certificate
  
• Create an A record for remote.externaldomain.com with the IP of the RDWeb server
  
• Edit the TMG Rule for RDWeb and when it asks for the computer name or IP to resolve enter remote.externaldomain.com
  

 

This will keep the certificate chain intact.

 

Are we talking internally here? So external should work?

 

So even though the hostname will be remote.internaldomain.internal and the certificate is remote.externaldomain.com the certificate will install into IIS ok?

 

 

Cheers

Edited October 21, 2010 by Guest

[penfold_99]

The certificate will install but you need to refer to the machine internal and external as remote.externaldomain.com so you don't get a certificate warning in IE etc

[Guest Guest]

The certificate will install but you need to refer to the machine internal and external as remote.externaldomain.com so you don't get a certificate warning in IE etc

 

Brill! Sorry if i didnt get my question accross very well

[wesleyw]

So you'll want to create another domain within DNS on your boxes really called then add an entry in there for the internal ip address of the server remotemachine (Host A record) make sure all of the PCs internally use the external website name and it'll resolve with the internal ip address but will keep the SSL Cert from causing an error has the added benefit of the staff and students only needing to know the one address as well. We've had to do this with about 6 internal servers soon to be growing to 9 (I don't want to buy single SSL certs for all of these and of course I'm bound to add more later).

 

 

Wes