I’m trying to use an SSL certificate and one-one dstNats, I can view the pages that have the certificates on the outside of the network but on the inside of my network we are unable to view them, I was hoping somebody could help me figure out how to fix this.
How are you calling the pages from inside your network? Is there a hotspot in the way? If so you probably need to allow access through the hotspot (walled garden) to the URL that issues the cerificate keys.
If the certificate is issued to https://www.yourdomain.com and the IP is a public address, you cannot call it by a local IP address. I have had trouble that way.
that’s exactly the problem I’m running into, we have private IP addresses that need to access a secured website inside of our network, it is a certificate authority certificate, but we need to be able to access it, we are wondering if maybe a proxy will help us out.
Is it possible to access the SSL pages from your localnet if you call them by the public IP?
no we can’t, our ssl certificate is bound to the public ip, but on the inside it directly routes them to the dst-nat numbers without bothering about the public ip’s. When we use the public IP’s a non signed ( non-ca certified) certificate passes through, it’s just the certificates we bought wont allows us to get to them from the inside
Have you considered allowing the SSL company certificate server through the hotspot? Maybe it is a signed certificate coming through, and your browser just can’t verify it.
it’s not a hotspot, I’m using dst-nat and src-nat rules to redirect traffic coming from the outside network to a specific set of numbers, ie changing 72.x.x.x to 172.x.x.x the ssl certificate is a signed certificate, but when the browsers look at it on the inside, they don’t see the number it’s signed to, the 72.x.x.x number, so we can’t log into the site that has it because the router automatically routes internal lan traffic to 172.x.x.x
My bad on the hotspot presumption. That Is a tough challenge. Is there a possibility of putting a routing-mark on the SSL port calls to the external IP and just let them through as-is, or modified only as much as necessary to make the connection?