SSL Certificates
-
@JaredBusch said in SSL Certificates:
Not for Exchange, no. Exchange needs a cert with more than a single valid name on it.
My current cert from GoDaddy only supports one valid name.
So if I go to the IP address directly it does not work. But the FQDN does.
I am thinking of more instances of things like my Palo Alto VPN I set up today, where it will take a CA cert instead of me using a self-signed one.
Is there something free in that realm?
Or even, what certificate services are you using? GoDaddy charges like $70.
-
what do you for onsite email? If it's exchange, do you have activesync or webmail? If you are using those things, it's typical that you'll have SANs in the cert for Exchange.
You could probably use a Let's Encrypt SSL, but you have renew it like every 90 days.. so that $70 for a year make the time of dealing with renewing so frequently worth it.
Also, you have a Palto Alto - the price for a SSL cert should be darn near meaningless.
-
@Dashrender said
what do you for onsite email?
We use MDaemon, which just requires one certificate. Though like I said if you try the IP address it doesn't like it.
-
@Dashrender said
You could probably use a Let's Encrypt SSL, but you have renew it like every 90 days.. so that $70 for a year make the time of dealing with renewing so frequently worth it.
From reading recent threads here, it just seemed like me paying for a cert was stupid, and that there were better options, even if not free.
But perhaps I am already on the right path.
-
@BRRABill said:
@Dashrender said
what do you for onsite email?
We use MDaemon, which just requires one certificate. Though like I said if you try the IP address it doesn't like it.
Sure, but the IP isn't listed in the cert, so the browser you're using to connect to the mail server doesn't see the IP in the cert.. so there's an error. I think there used to be a time when you could add an IP... but not sure that's allowed anymore.
-
@Dashrender said
Sure, but the IP isn't listed in the cert, so the browser you're using to connect to the mail server doesn't see the IP in the cert.. so there's an error. I think there used to be a time when you could add an IP... but not sure that's allowed anymore.
So, you need two certs then?
-
@Dashrender said
Also, you have a Palto Alto - the price for a SSL cert should be darn near meaningless.
Don' t be a hater...
LOL.
-
I'm using a GoDaddy cert for my Exchange server - my Multi-domain SAN (not SDN) cert is worth it.
When you can use the tools to automatically request, install, etc the SSL Then Let's Encrypt is worth it.. but when you have to deal with a lot of manual junk.. nah...
-
@BRRABill said:
@Dashrender said
Sure, but the IP isn't listed in the cert, so the browser you're using to connect to the mail server doesn't see the IP in the cert.. so there's an error. I think there used to be a time when you could add an IP... but not sure that's allowed anymore.
So, you need two certs then?
Why would you need two?
-
@Dashrender said
Why would you need two?
I've only ever followed the directions from MDaemon to generate a certificate for what I need, which is always in the format of
Are you saying I can add the straight IP as well? On the same one?
-
according to this
https://support.globalsign.com/customer/portal/articles/1216536-securing-a-public-ip-address---ssl-certificatesyou can have the IP be the common name. You can use SAN Secondary Address Names to a single cert (SAN certs cost more money, but one cert can have at least 5 additional names, maybe more, so you save money )
So if you wanted the IP to not give errors, then you could set the IP as the common name, and mail.domain.com in the SAN
Though I wonder, why do you need the IP itself to not give an error? Do you purposefully have users use the IP? If not, and it's only you using the IP, then why spend money, you know you can safely ignore the error.
-
That might work for my other stuff, though.
If I can do DOMAIN.COM and then
vpn.domain.com
mail.domain.com
iDRAC.domain.comto fill all my certificate needs
-
Startssl is free, It's easy to create and install.
-
@BRRABill said in SSL Certificates:
That might work for my other stuff, though.
If I can do DOMAIN.COM and then
vpn.domain.com
mail.domain.com
iDRAC.domain.comto fill all my certificate needs
Why would you do domain.com? That's not a real service is it? it's generally better off being a redirector to a real service like www.domain.com.
-
@BRRABill Yeah. Last time we updated at work I paid a little extra for a wildcard cert. So *.domain.com, it's all valid for the one cert.
For my personal server, I just run Let's Encrypt.
-
@travisdh1 said in SSL Certificates:
@BRRABill Yeah. Last time we updated at work I paid a little extra for a wildcard cert. So *.domain.com, it's all valid for the one cert.
For my personal server, I just run Let's Encrypt.
How much is a little? The last time I looked (it's been many years) a wildcard cert was 5X the cost of a normal cert, maybe more.
-
@Dashrender said in SSL Certificates:
@travisdh1 said in SSL Certificates:
@BRRABill Yeah. Last time we updated at work I paid a little extra for a wildcard cert. So *.domain.com, it's all valid for the one cert.
For my personal server, I just run Let's Encrypt.
How much is a little? The last time I looked (it's been many years) a wildcard cert was 5X the cost of a normal cert, maybe more.
You can pickup a Comodo cert for $94/year. Looks like today's pricing has majorly changed since the last time I bought a cert, single site certs for $9. Let's Encrypt is having a real nice effect on the market!
-
@Dashrender said
Why would you do domain.com? That's not a real service is it? it's generally better off being a redirector to a real service like www.domain.com.
That was an example.
Even after yesterday I still seem to be afraid to post real details online!
vpn.brrabillisafraidoftheinternet.com
mail.brrabillisafraidoftheinternet.com
iDRAC.brrabillisafraidoftheinternet.com -
For me it wasn't so much the cost as wondering of there was a better way than what I was doing.
Part optimization, part learning what else might be out there.
-
@BRRABill said in SSL Certificates:
@Dashrender said
Why would you do domain.com? That's not a real service is it? it's generally better off being a redirector to a real service like www.domain.com.
That was an example.
Even after yesterday I still seem to be afraid to post real details online!
vpn.brrabillisafraidoftheinternet.com
mail.brrabillisafraidoftheinternet.com
iDRAC.brrabillisafraidoftheinternet.comLOL - if the host name is in DNS - then your non posting of the real links here is doesn't gain you anything.
Google undoubtedly is looking through all of the newly registered domains daily (or rather minutely). Then Google looks to see if those domains have DNS entries, if they do, they then query every record it can in DNS. Then I bet it attempts to connect to at least the root of every record listed there, then starts the spidering.
The main reason to not post your real domain is to keep script kiddies who peruse forums like these for things to attack just because you were talking about it.
