SSL certificate cname verification

cname-recorddns-zonessl

I have renewed the company website's SSL certificate but need to verify ownership of the domain by adding a Cname to the DNS. I've not got much experience installing SSL certificates and I'm struggling to get it to work.

We use AWS route 53 DNS and the record that i need to add is shown like this:

randomlettersandnumbers.www.example.com. 10800 IN CNAME randomlettersandnumbers.comodoca.com.

I find this a little confusing, but I'm pretty sure the example.com should be the name for the record and the comodoca.com for the value. However the TTL is set to only 300 and it has yet to be detected by the SSL site. Maybe i should set it to 10800 but I'm not sure it matters too much?

Any ideas what may be going wrong, I've never used AWS's DNS before so maybe it works differently to others?

Best Answer

It doesn't matter if you have 10800, more or less. TTL (Time To Live) is the speed (in seconds) you want to refresh your DNS. 10800 = 3 hours, 300 = 5 minutes. After the time passed your SSL record will be able to verify ownership of the domain.

Related Solutions

Domain – How to set up the CNAME in DNS zone record to work with Unbounce

Short answer: all extremely bad&mad

Long answer

> Quering 65.98.33.192 for {beta.devboost.com.,ANY}
; Answer ID: 18467  QR: true  OPCODE: QUERY  AA: true  TC: false  RD: true
; RA: false  RCODE: NOERROR  qc 1  an 6  au 0  ad 2

; Question section:
;beta.devboost.com. IN ANY

; Answer section:
beta.devboost.com. 1d IN MX 10 mail.beta.devboost.com. 
beta.devboost.com. 1d IN MX 21 mail2.beta.devboost.com. 
beta.devboost.com. 1d IN A 65.98.33.193 
beta.devboost.com. 1d IN SOA ns1.SNARE.arvixe.com. hostmaster.beta.devboost.com. 2011111006 3600 600 1209600 86400 
beta.devboost.com. 1d IN NS ns2.SNARE.arvixe.com. 
beta.devboost.com. 1d IN NS ns1.SNARE.arvixe.com.

Ok, it seems as subdomain of devboost, but - I can't AXFR devboost zone from primary NS (bad one) for verify, screenshot show me useless CNAME record instead of mandatory NS glue records (bad two)

ADD: Final observaton

Well, now I have read Unbounce "KB" and I have to say only one: "Forget this crap". In order to get landing page on Unbounce web-server for host beta.devboost.com in domain devboost.com you have

remove subdomain beta., totally
~~add RR (host) beta into domain devboost.com with type CNAME, pointing to unbouncepages.com (record idetical to CNAME record on screenshot for beta. subdomain)~~I overlooked CNAME, you already have it in zone
Nothing more, after expiration time for old bad data you'll see expected result

CNAME not resolving

Technically what you're asking for is invalid. CNAME conflicts with all other records (with a special exception for DNSSEC records), thus having CNAME xxxxx conflicts with the SOA, MX, NS etc records for the domain. My guess is that the reason the domain resolves when you use an A there and fails when you use CNAME is because the DNS server enforces those restrictions and is unable to process your zone file.

Furthermore, based on your response to @xwincftwx's question, it's not clear that getting CNAME to work would do what you want in the first place. A CNAME pointing to an A record is exactly the same as an A record in the first place. The CNAME is handled entirely internally by the DNS system and the web browser only sees the IP address. In your test with an A record (let's say 1.2.3.4), the browser connected to 1.2.3.4 and asked it for the website example.com. If that server isn't configured to serve a website for example.com it typically serves a default site (in this case blogs.com).

If you got your domain to work as a CNAME, the browser would ask for the IP address of example.com. DNS would see that it is a CNAME, look up example.blogs.com and return 1.2.3.4. The browser would connect to 1.2.3.4 and ask it for example.com just as it did when it was an A record.

If you want people going to example.com to be redirected to example.blogs.com then you'll need to set up a basic web server that receives connections to example.com and sends a 301 permanent redirect to the browser to tell it go to example.blogs.com

Best Answer

Related Solutions

Domain – How to set up the CNAME in DNS zone record to work with Unbounce

ADD: Final observaton

CNAME not resolving

Related Topic