DNS name alias + different reverse DNS (CNAME) = fail? IP = work?

Nadrek · May 11, 2014, 3:52 PM

Question:
How can I get aliases of sites like ocsp.startssl.com or ocsp.rapidssl.com to work based on DNS names - both of them lead to Akamai servers per Dig or reverse DNS?

Situation:
I'm attempting to lock down a network (VMWare ESXi, separate virtual NIC leading to a separate, isolated vSwitch) for outbound access, and OCSP is a concern.

Thus, I set up an alias for Certificate Authorities, and then add in a Host entry for
ocsp.startssl.com

And put a rule on the local OptN interface the traffic will come from to allow IPv4 TCP port 80 to that alias.

This fails.

Putting the hardcoded IP address of the Akamai server does actually work.

Dig results are:

;; QUESTION SECTION:
;ocsp.startssl.com. IN A

;; ANSWER SECTION:
ocsp.startssl.com. 5 IN CNAME www.startssl.com.edgesuite.net.
www.startssl.com.edgesuite.net. 5 IN CNAME a1603.g1.akamai.net.
a1603.g1.akamai.net. 5 IN A 23.63.227.168
a1603.g1.akamai.net. 5 IN A 23.63.227.128