I just learned that, for whatever reason, domain names can get resolved to the wrong IP address, therefore requests can hit the wrong servers. (Just some examples of erroneous domain resolutions from Server Fault: 1, 2, 3.)
Now, if this scenario does happen and the server is configured to accept every HTTPS requests (such as in the NGINX config at the bottom), where will the process fail?
For example, if the 2 parties are server and client:
server's TLS certificate is fordomain.namewheredomain.nameresolves to the IP address ofserver.clientwants to visithttps://another.org/, but, for some unforeseen reason, it resolves toserver's IP address.
I have a vague idea:
client(erroneously) hits upserverwith an HTTPS requestThis kicks off a TLS handshake
... which should go through because, as far as I know,
clientwill only verify the validity ofserver's certificate, and not if the domain nameclientrequested matches the domain inserver's certificate.The first requests go through the newly established TLS connection, but all will fail in the application level as nothing makes sense.
The fairly standard NGINX config:
#############
# CATCH-ALL #
#############
server {
listen 80 default_server;
server_name _;
return 404;
}
##########################
HTTP-to-HTTPS redirect
##########################
server {
listen 80;
server_name ourdomain.com;
return 301 https://ourdomain.com$request_uri;
}
#########
HTTPS
#########
server {
listen 443 default_server ssl http2;
ssl_certificate /path/to/signed_cert_plus_intermediates;
ssl_certificate_key /path/to/private_key;
# ... rest of the instructions ...
}
@toraritte can you reformulate this question to something like: "in a HTTPS scenario where there is a 'catch all' server, and a client gets routed to this server for some reason. where in the process will the error happen that prevents exchange of data?"
– LvB Aug 14 '23 at 09:52