yoooyo

Network notes / HTTPS

Verify the name, then read the response.

HTTPS combines a TLS connection with an HTTP exchange. A valid certificate and a useful application response are related checks, not the same result.

The hostname matters

During connection setup, a browser normally sends the intended hostname using Server Name Indication (SNI). A shared server uses it to select a TLS configuration. The browser then checks the certificate's trust chain, validity period and names against the hostname in the URL.

Opening an IP address instead of the hostname is not an equivalent check. It can select a different virtual host and the certificate may not cover that IP. A CNAME also does not change which hostname the certificate must cover.

Make a request with validation enabled

The following command fetches the public homepage, discards its body and prints the response headers. It leaves certificate and hostname verification enabled and stops after a bounded time:

curl --connect-timeout 10 --max-time 20   --dump-header - --output /dev/null   https://yoooyo.co.uk/

On Windows, use curl.exe and replace /dev/null with NUL. Do not add -k or --insecure to make an error disappear. If validation fails, check the exact hostname, system clock, certificate expiry and trust chain.

For an authorised origin check before a DNS change, curl --resolve hostname:443:address https://hostname/ can select an address while preserving SNI and hostname verification. Replace the example words with the intended values. This still requires a valid certificate for that hostname.

Interpret the HTTP layer

  • 2xx: the server accepted this HTTP request. It does not prove other URLs or protocols work.
  • 3xx: inspect the Location header before following the redirect. A redirect may be intentional.
  • 4xx: the request reached an HTTP service, but the resource, permissions or request format may be wrong.
  • 5xx: the server or an upstream dependency failed to handle the request. The TLS connection may still be valid.

A timeout before headers is different from an HTTP error. Note whether the tool failed during name resolution, TCP connection, TLS negotiation or after sending the request.

Certificates have an operational owner

Certificate issuance and renewal depend on control of the hostname and successful validation. HTTP-based validation needs its challenge to reach the correct server; DNS-based validation needs the correct authoritative DNS record. Moving an address alone does not move a certificate or its private key.

Keep the existing renewal mechanism and private-key storage intact during a migration. A valid certificate today is evidence about today's connection, not proof that the next renewal will succeed.

Next: work through the connectivity checklist.