Re:The modern HTTPS world has no place for old web servers
by tialaramex on Wednesday May 13, 2020 @06:40AM
(#23165498)
You cannot obtain certificates in the Web PKI ("SSL Certificates" that "just work" in people's browsers) for private names like this "friendlymachinename". Public CAs are forbidden from issuing anybody such a certificate.
Such names are a bad idea for a wide variety of reasons and you should definitely look to give the machine a name from the Internet's DNS (even if the machine isn't accessible in any way from the public Internet), but assuming you cannot or don't want to for now:
You can use a variety of thin "reverse proxy" services to just wrap the HTTP service as HTTPS. Many such webapps won't care that this happened, as the maintainer you probably have a good sense of whether it could work (does the webapp use Javascript that cares about its own URLs for example because that could be a problem?). HTTPS servers such as nginx are well suited to this problem. Security between the wrapping proxy HTTPS server and your PHP on IIS setup is still zero in this setup but that might be acceptable.
Such names are a bad idea for a wide variety of reasons and you should definitely look to give the machine a name from the Internet's DNS (even if the machine isn't accessible in any way from the public Internet), but assuming you cannot or don't want to for now:
You can use a variety of thin "reverse proxy" services to just wrap the HTTP service as HTTPS. Many such webapps won't care that this happened, as the maintainer you probably have a good sense of whether it could work (does the webapp use Javascript that cares about its own URLs for example because that could be a problem?). HTTPS servers such as nginx are well suited to this problem. Security between the wrapping proxy HTTPS server and your PHP on IIS setup is still zero in this setup but that might be acceptable.