The question was:
On Tue, 2010-12-21 at 22:53 -0800, S Mathias wrote:
http://help.godaddy.com/article/1054 "# Set up SSL protection on your website." is it an inescapable requirement to have a dedicated [not fix] ip address, when i want to use ssl on my domain?
and one reply asseted:
On Wed, 22 Dec 2010, Adam Tauno Williams wrote:
Yes.
Reverse DNS has to be working.
ehh? so what? It is perfectly possible to update PTR records dynamically, just as with CNAMEs or A records
A CSR countersign by a CA is from information totally ignorant of the actual IP's in play [see the req_distinguished_name stanza of such requests as to the information needed, below] -- indeed, such IPs need not even be allocated, nor the host live, before a key file is generated, a CSR submitted to a CA and countersigned, and a PEM returned by the CA to the requestor
Managing DNS, and placement of a PEM, key and chain into the hosts providing a SSL accessible website (mailserver, etc) are totally disjunct from the specific IP's a host is at for a given time
[ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = US countryName_min = 2 countryName_max = 2 stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Ohio localityName = Locality Name (eg, city) localityName_default = Columbus 0.organizationName = Organization Name (eg, company) 0.organizationName_default = 781 Resolution, LLC organizationalUnitName = Organizational Unit Name (eg, section) commonName = Common Name (eg, your name or your server's hostname) commonName_max = 64 emailAddress = Email Address emailAddress_max = 63 emailAddress_default = domains@781resolution.com
The 'commonName' field here is usually the FQDN, and may be an A record or a CNAME; validations are optionally done by a remote host querying the PTR record values to make sure there is a name match in the array returned [a PTR is usually unique and one to an IP, but I am not specifically aware of a formal RFC requirement of only one PTR record per IP, having looked again for such writing some code on DNS content validation for an interface that builds zone files in the last few months]
-- Russ herrold