Link to home
Start Free TrialLog in
Avatar of Peterson50
Peterson50Flag for United States of America

asked on

Setting up FileMaker Webdirect SSL certificate

We have FileMaker server 14 running with no problems but need to install a ssl certificate, the question I have is in regard to the domain name provided to the ssl certificate. Does it need to match the name of the server which is fmvirtual as its running in a vm. But the way we access it is via a dyndns.tv pointer to the IP address. Just confused and need some advice.
SOLUTION
Avatar of btan
btan

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
You can/should subject alternate name (SAN) if you have several hostnames you use to access it
Myhost.mydomain.com
FileMaker.mydomain.com
.local based domains are no longer signed by public CAs.

Your DNS for host.mydomain.com will be an alias to your dyn DNS host.

Thus is done on the certificate request generation part.

If memory .... FileMaker is a Data source.. Don't you have a separate web server?
Avatar of Peterson50

ASKER

Excuse my ignorance but just so I understand.

For sake of example
Our domain name is my company.com hosted by an ISP
Our internal server has hq.mycompany.com
The Filemaker Server is fmvirtual.hq.mycompany.com

Is the ssl certificate for filemaker registered to mycompany.com or should it be fmvirtual.hq.mycompany.com?

When it is purchased the owner of my company.com received confirmation of the certificate?

Thanks for help
It should be registered under the name it is being accessed. Using SAN certificate, you can gave multiple valid names within the certificate.
Do you access the page as www.mycompany.com and through it it accesses the FileMaker server?

What platform are you on?
Avatar of btan
btan

Agree with arnold too. That will be a more common access as you do not expose internal server hostname. Other server name will be as alt subject name or known as SAN or UCC certificate.

Here is a faq from Digicert which explain the options

What Can You Do with Subject Alternative Names?

Secure Host Names on Different Base Domains in One SSL Certificate: A Wildcard Certificate can protect all first-level subdomains on an entire domain, such as *.example.com. However, a Wildcard Certificate cannot protect both www.example.com and www.example.net.

Virtual Host Multiple SSL Sites on a Single IP Address: Hosting multiple SSL-enabled sites on a single server typically requires a unique IP address per site, but a Multi-Domain (SAN) Certificate with Subject Alternative Names can solve this problem. Microsoft IIS and Apache are both able to Virtual Host HTTPS sites using Multi-Domain (SAN) Certificates.

Greatly Simplify Your Server's SSL Configuration: Using a Multi-Domain (SAN) Certificate saves you the hassle and time involved in configuring multiple IP addresses on your server, binding each IP address to a different certificate, and trying to piece it all together.
https://www.digicert.com/subject-alternative-name.htm
Platform Windows server 2012. It is being accessed via a mycompany.dyndns.tv
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
The alias can be via the CNAME approach and it is commonly done as for websites requiring CDN or DDoS cloud protection. The customer is advised to use their WWW site as no change and CNAME to those proxy services which eventually will forwarded to the customer origin web server.  Those services provides the add on high availability and secured checks prior to passing on to the origin. In your case, I see similar use case as well. SSL cert is for WWW while you can CNAME in the your dns server to the dyndns services.
I think I understand this now.

I get the certificate registered to fmvirtural.hq.mycompany.com  (We have domain with GoDaddy.com)
I can then also list alt subject or name as mycompany.dyndns.tv in certificate
Then in godaddy do a cname change so that something listed as fmvirtual.hq.mycompany.com automatically resolves to mycompany.dyndns.tv

Am I correct?  Also is registering the certificate in IIS different than in Filemaker which provides the ability to import the SSL certificate

Thanks for the help greatly appreciated
yes. the certificate with Subject alternate name has to be done from the start.  You can not add SAN after the certificate is obtained.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial