How to force routing to https website without the IP

Question

I am attempting to limit a group of Chromebooks to access one particular site for student testing. The issue is that the website is secure but the ssl cert is attached to the url not the ip. The ip of the host actually points to several sites hosted by the company and w/o the ssl cert none will resolve. Is there a way to do this? My firewall requires ip for rule not url, dns needs the ip, host files need ip? At the moment I also cannot change anything on the CB's as they are not yet enterprise licensed with Google. I would like to do this through networking so the CB' or any other computer used for testing on this network would be forced to the site. Running a Ubiquiti Edge router, Cisco managed POE switch and a Unifi AC Lite AP for wifi

Answer 1

If your firewall requires the use of IP addresses then that is the only way. Resolve the name to all IPs and enter those in the firewall's permit rule(s).

You might also want to permit traffic to/from the DNS server and to/from the OCSP or CRL servers that are used with the certificate.

If you want to force the Chromebooks to that site, regardless of which URL they call, you'll need a captive portal setup. For that to work with SSL requests, you'd also require SSL deep inspection, using a custom root CA certificate, which likely isn't possible with the Chromebooks without MDM.