Forum Moderators: phranque

Message Too Old, No Replies

HTTPS hit to Verizon IP returns invalid Microsoft-domain certificate?

internet-detective stuff

         

SumGuy

2:21 am on Apr 1, 2021 (gmt 0)

5+ Year Member Top Contributors Of The Month



I was looking through my router's logs and came across an intentionally-dropped outbound packet from an office PC. This alone isn't unusual, seems that browsers tend to fire off at least one last packet to a closed connection to a web server and routers will drop those from getting onto the wan.

The IP in this case was 72.21.81.200. It's a Verizon IP. For the heck of it I tried to connect to it (https) and got a browser warning (SSL_ERROR_BAD_CERT_DOMAIN). 72.21.81.200 uses an invalid security certificate.

I looked at the details - hmm. I see dozens of microsoft-related domains. A little bit more digging about the IP:
AS15133 EdgeCast Networks, Inc. d/b/a Verizon Digital Media Services

I don't know. Maybe there's "nothing to see here". I just find it strange that a server serving up content associated with those domains wouldn't be doing so from an actual Microsoft IP. As to why the certificate is invalid, I'm not sure. Is this expected behavior when you hit a HTTPS server on it's IP?

lammert

8:00 am on Apr 1, 2021 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



This IP range is part of a CDN network and serves content on behalf of other parties. You only get valid certificates if you connect to them with a valid domain name. If you connect through the IP address, it will give you whatever certificate is first in its configuration. And that certificate is most likely not associated with the IP address but with a domain name, causing the SSL_ERROR_BAD_CERT_DOMAIN error.