Potential DNS Rebind attack detected and Web UI Certificates

[Kajetan321]

I have HA with CARP going on two identical hardware platform (Netgate 6100). What’s the best way to setup Web UI SSL/TLS Certificates?

We have a Windows Server CA running. I was able to get a single certificate signed and installed on both platforms. Is that the correct way to do it? For the certificate I have entered numerous Alternative Names, the three local IP addresses associated with the two firewalls and three host names associated with the three IP addresses (pfsense, pfSense1, fpsense2). Problem is when I try to access using the “pfSense” host name (the host name associated with the virtual IP) I get:

Potential DNS Rebind attack detected, see https://en.wikipedia.org/wiki/DNS_rebinding
Try accessing the router by IP address instead of by hostname

What can be done? Can that check be disabled? If there a better approach?

[johnpoz]

@Kajetan321 the vip just points to one of them, whoever is the master. So yeah to it the name is not correct.

What you would want to setup is alternative name..

so if you pfsense1.home.arpa, and pfsense2.home.arpa on the 2 boxes. Here for the vip name you would want pfsense.home.arpa

This is located under system / advanced / admin access