Good Morning,
I am trying to get clarification on some options for our situation.
Our domain was originally setup as a .local naming scheme.
We now have more applications that are no longer going to be accepting self assigned certs and require a public domain SSL certifications for LDAPS authentication.
As of right now all our domain controllers are named .local because our domain is named .local. I have searched a lot of articles and see some conflicting information regarding whether it is possible to assign a public cert to a dc named .local. I
know you can no longer get directly published certs pointing to .local and most also do not allow the Subject Alternative Name to contain .local either.
I ran across some comments that claim you can simply use split DNS and assign an internal public domain redirect that resolves to that domain controller. Whenever we tried doing this, the SSL cert was still rejected by all clients due to the actual
name of the server.
Here is a similar setup to or situation
dc1 - 192.168.1.1 - AD Name dc1.local
cert we purchased was dc1.contoso.com
external dns(public ip) dc1.contoso.com - NAT resolves to internal dc1.local
internal dns dc1.contoso.com also resolves to dc1.local ip address
In the end both external and external dns entries resolve to dc1.local ip address in the end.
We created the dc1.contoso.com cert with the exported information from the dc and then re-imported as instructed. Some commenters suggested you could at this point simply create and internal and external dns reference that points all dc1.contoso.com
to the same ip as dc1.local
After experimenting with this we were unable to get this to work. Even though the dns may resolve the same ip of dc1.local, the connection would fail. the error message would indicate that the name did not match. The cert expects a server
with a name of dc1.contoso.com but gets one with the real name of dc1.local which makes sense.
My question - Is there any legitimacy to this method? If so, how do you get around the error of the server always returning it's real name of .local and causing SSl authentication failure?
Any help would appreciated in this matter.