0

I am attempting to limit a group of Chromebooks to access one particular site for student testing. The issue is that the website is secure but the ssl cert is attached to the url not the ip. The ip of the host actually points to several sites hosted by the company and w/o the ssl cert none will resolve. Is there a way to do this? My firewall requires ip for rule not url, dns needs the ip, host files need ip? At the moment I also cannot change anything on the CB's as they are not yet enterprise licensed with Google. I would like to do this through networking so the CB' or any other computer used for testing on this network would be forced to the site. Running a Ubiquiti Edge router, Cisco managed POE switch and a Unifi AC Lite AP for wifi

1
  • Routing requires IP addressing. There are no names, only addresses, at or below layer 4 in the network stack. Names, including URL/URI, are an application-layer thing. The network does not know or care about names, which would be in the payload of transport datagrams.
    – Ron Maupin
    Sep 1 at 12:24
0

If your firewall requires the use of IP addresses then that is the only way. Resolve the name to all IPs and enter those in the firewall's permit rule(s).

You might also want to permit traffic to/from the DNS server and to/from the OCSP or CRL servers that are used with the certificate.

If you want to force the Chromebooks to that site, regardless of which URL they call, you'll need a captive portal setup. For that to work with SSL requests, you'd also require SSL deep inspection, using a custom root CA certificate, which likely isn't possible with the Chromebooks without MDM.

1
  • Thank you for the assistance, I was sure there wasn't a way around it, but I've been out of the network side of it and just wanted to ask. Sep 1 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.