PCI Compliance & SSL Cert Merry-Go-Round

[HCHTech]

I have an internet-connected credit card terminal, which means I have to endure quarterly penetration scans to get PCI compliance. This quarter, I failed the scan because I don't have a third-party SSL.

The failure message is pointing to the port I have open to allow me to VPN into my network from the field and says "SSL Certificate - Signature Verification Failed Vulnerability". Under "How to Remediate", it says "Please install a server certificate signed by a trusted third-party Certificate Authority."

Now, mind you, I don't have a domain or a server here. I have Static IP business internet, with a Sonicwall firewall. I have my cc terminal in it's own security zone, as well as separate zones for client computers and my own business computers.

I looked into obtaining an SSL for this purpose, but it seems I cannot obtain an SSL without a fully qualified domain name. Apparently, it used to be possible to get an SSL for an IP address, but some change in the rules must have stopped that. When browsing through the FAQs on two separate certificate vendors, it says something like "as of November 1, 2015, we no longer issue certificates without a FQDN."

First, I thought I could just use a NoIP or DynDNS address (pointing to my IP) as the FQDN, but that didn't work because the vendor requires that you be able to receive email to admin@domain.com on the FQDN you enter for the certificate to validate your order. I could purchase email forwarding for another few bucks, but before I go further down that rabbit hole, I thought I'd better stop and get the advice of folks who know more than I do about these things.

Am I missing something simple here?

 

[YeOldeStonecat]

Well, you have a static IP.
So creating an external FQDN for it is easy peasy.
Let's assume you already have a domain registered for your business, like hchtech.com
Whip up an a-record like "sonicwall.hchtech.com", point it to your primary static public IP address, and make the SSL cert under that name.

 

[HCHTech]

Ohhhhh. Duh. Right - that's the same idea behind creating remote.xxx.com for employees to use for RWW, or mail.xxx.com for OWA. Now that makes sense - thanks! There are days I think I'm pretty good at this stuff and days where I think I need to go back a grade. You can guess which one this day is.

 

[fencepost]

Even if you're dynamic you can probably do this pretty easily depending on where the domain is registered. One of the things I really like about Namecheap is that they include free dynamic DNS if you're using their DNS server. I've even been known to set it up to dynamically update even on a static connection when the backup/failover line is dynamic.

 

[Markverhyden]

I've never needed a static IP to get an SSL cert. Just ownership of the root FQDN.