Map the lab hostname

Our certificate says app.lab.test, but the server lives at 127.0.0.1. TLS name verification uses the hostname from the URL. The client takes that name and checks it against the certificate’s SAN entries. Connect by IP and the check fails, because 127.0.0.1 is not one of the names we issued.

So we need a way to type https://app.lab.test:8443/ and land on loopback. There are two tools for this. curl’s --resolve option, and the hosts file. Let’s start with the narrow one.

--resolve tells curl to use a specific address for one hostname and port, for this command only. Nothing else on the machine changes:

curl --resolve app.lab.test:8443:127.0.0.1 https://app.lab.test:8443/
# curl: (60) SSL certificate problem: unable to get local issuer certificate

It still fails, and it should. The lab root is not trusted yet. But look at what changed: curl no longer complains about the name. It resolved app.lab.test to loopback, sent that name as SNI, matched it against the certificate SAN, and failed only on the missing trust anchor. One problem left instead of two.

If you want the mapping to apply to every tool on the machine, a browser, Node scripts, anything, add a hosts file entry instead:

echo '127.0.0.1 app.lab.test' | sudo tee -a /etc/hosts

The hosts file is consulted before DNS, so every process now resolves app.lab.test to loopback. Remove the line when the lab is done. Stale hosts entries cause confusing “works on my machine” bugs months later, when the same name gets used somewhere real.

I prefer --resolve for labs. It leaves no trace, and the mapping sits right there in the command, next to the test it belongs to.

The .test top-level domain is reserved for exactly this. It will never be registered publicly, so your lab names can’t collide with a real site. That’s why this course uses app.lab.test and not something ending in .com.

Which brings us to the rule: don’t issue local certificates for a public hostname you don’t control. If your lab signs a certificate for someone else’s domain and the mapping leaks into a real environment, you’ve built a small impersonation setup. Reserved names keep the whole exercise contained.