Nimbostratus
Hi Team,
One quick question, suppose we add an alias under GTM wide IP. shall we need to update LTM VIP also which is behind the gtm pool with client profile certificate? means certificate should also require this alias name in its san entry?
Thanks,
Neha
Nacreousit's usually not needed.
in short, the hostnames in ssl certificate only need to match to the hostname of the http layer request.
client's ssl layer will automatically uses that http layer hostname for tls sni request field.
also, http and ssl/tls layer doesnt care about dns cname things.
so if the hostname in http(s)://<hostname>/........... doesnt change, then you dont need to update the ssl cert.
NimbostratusThankyou!!
from the Host name here are we referring URL/FQDN name we have A record for?
Nacreousbasically yes.
e.g. eventhough the url's fqdn is cnamed thousands times, the client's http and ssl/tls layer doesnt care about it.
these layers only read resulted ip address.
NimbostratusThanks zamroni777
But it didn't work. we updated Alias but still its giving certificate error. so seems San name needed in Cert.