CODEWITHSUNDEEP
asp.net.htaccessiisssliis-7.5
parag
parag

Reputation: 2573

SSL Certificate issue to the end user

I have a web site developed in Asp.Net and it is hosted in cloud. Site is running on https protocol and certificate is issued to domain (E.g. example.com ) and subdomain (*.example.com). It works well if user types example.com or app.example.com. However some user types URL incorrectly. They type something like www.app.example.com. In this case browser displays warning about certificate. It states something like this “This server could not prove that it is www.app.example.com; its security certificate is from *.example.com. This may be caused by a misconfiguration or an attacker intercepting your connection”

This is perfectly fine since subject name (or issued to) is not matching since it involves two subdomains i.e. first subdomain is www and another subdomain is app. Many user scare to do that and they will leave the web site. By googling I found, problem can be fixed by regenerating the certificate with additional subject alt names such as *.example.com and ..example.com. But IT staff do not want to regenerate the certificate for some reason. Is there any alternative to fix this problem without regenerating certificate. Expectation is that any error message should not be displayed and any extra action should not to be required from the end user.

I have tried with redirect rules in IIS. But they are not working.

Platform details – Asp.Net MVC 5, IIS 7.5 and Windows Server 2008 R2 datacenter

Upvotes: 0

Views: 939

Answers (1)

Steffen Ullrich
Steffen Ullrich

Reputation: 123260

Is there any alternative to fix this problem without regenerating certificate.

No. The certificate must match the name. If the certificate does not match user gets an error. There is no way around it and if there would be one this could be considered a security risk, because without a proper name check man-in-the-middle attacks would be possible.

I have tried with redirect rules in IIS. But they are not working.

Redirects are done at the HTTP level, which means with https it first needs to establish the SSL connections. If this fails because of the name mismatch then the redirect will not be reached.

Upvotes: 2

Related Questions