DNS name alias + different reverse DNS (CNAME) = fail? IP = work?
Nadrek last edited by
I'm attempting to lock down a network (VMWare ESXi, separate virtual NIC leading to a separate, isolated vSwitch) for outbound access, and OCSP is a concern.
Thus, I set up an alias for Certificate Authorities, and then add in a Host entry for
And put a rule on the local OptN interface the traffic will come from to allow IPv4 TCP port 80 to that alias.
Putting the hardcoded IP address of the Akamai server does actually work.
Dig results are:
;; QUESTION SECTION:
;ocsp.startssl.com. IN A
;; ANSWER SECTION:
ocsp.startssl.com. 5 IN CNAME www.startssl.com.edgesuite.net.
www.startssl.com.edgesuite.net. 5 IN CNAME a1603.g1.akamai.net.
a1603.g1.akamai.net. 5 IN A 184.108.40.206
a1603.g1.akamai.net. 5 IN A 220.127.116.11