 |
 |
Yeah, in the latest EZProxy version you can use a multi-domain cert with the wildcard in the SAN. Be sure when you request your cert with the EZProxy CSR you get a multi-domain cert, otherwise it won't matter what you've selected for the SAN. Best regards, *Jason Bengtson* www.jasonbengtson.com On Wed, Feb 17, 2016 at 12:17 PM, Gorman, Jon <[log in to unmask]> wrote: > > Hi Code4Lib, > > We're looking into applying an SSL certificate to an EZproxy server and > aren't > > sure exactly how a wildcard cert gets handled in that context. > > Anyone have experience with this? > > Yup. > > > The fuzzy part is that we're not clear how wildcard certificates that > handle > > subdomain matching (e.g., *.example.org) translate into wild-looking > proxied > > domains (like search.whatever.com.proxy.example.org). > > This depends a lot on the version number of EzProxy. > > The older versions of EzProxy look for a couple of things: > > * proxy-by-hostname needs to be on (sounds like you have that) > * The wildcard MUST be in the CN, not a SAN. You'll likely want to use > your login domain in the SN, depending on levels. > > Given those two things, when ezproxy sees that it has a wildcard in the > CN, it'll change from using periods to hypens. > > I think, although I can't remember for sure, at some point in 6.x this was > fixed so a wildcard in a CN or SAN will work. I'd definitely verify that > through testing though. > > A license of ezproxy should let you run a separate test instance on > another machine. You can verify this by just creating a self-signed > wildcard cert. You'll get a warning, but you should also see the ezproxy > behavior change. I find dnsmasq can be helpful as well. > > So you'll want to get a wildcard cert for the one level of subdomain. > While you're at it, make sure it's a 2048 bit key and SHA-2. I've been > seeing a lot of people running into problems with old 3 year certs that > they finally gotten around to putting into place. > > > > This might be more of an EZproxy config question and more appropriate to > that > > list. There's also documentation > > < > https://www.oclc.org/support/services/ezproxy/documentation/cfg/ssl.en.ht > > ml> > > out there. But if anyone can comment on the process, whether the > > documentation was helpful to you, what sort of wildcard cert you got to > > address this problem, etc., we'd be interested to hear from you. > > It's asked frequently enough that if I wasn't quite so lazy, I'd make it > into the top FAQ question. The documentation was ok, but it's really not > all that complicated. > > > > Jon Gorman > Library IT > University of Illinois > 217 244-4688 >