Map the lab hostname

Our certificate says app.lab.test, but the server lives at 127.0.0.1. TLS name verification uses the URL hostname: the client takes the name from the URL and checks it against the certificate’s SAN entries. Connect by IP and the check fails, because 127.0.0.1 is not one of the names we issued.

So the lab needs a way to type https://app.lab.test:8443/ and land on loopback. For a local lab, map app.lab.test to loopback through the hosts file or curl --resolve.

The --resolve option is the narrowest tool. It tells curl to use a specific address for one hostname and port, for this command only. Test without a global hosts-file change:

curl --resolve app.lab.test:8443:127.0.0.1 https://app.lab.test:8443/
# curl: (60) SSL certificate problem: unable to get local issuer certificate

The first attempt should fail because the lab root is not trusted yet. That is the correct security behavior. But notice what changed: curl no longer complains about the name. It resolved app.lab.test to loopback, sent that name as SNI, matched it against the certificate SAN, and failed only on the missing trust anchor. One problem left instead of two.

If you want the mapping to apply to every tool on the machine — a browser, Node scripts, anything — add a hosts-file entry instead:

echo '127.0.0.1 app.lab.test' | sudo tee -a /etc/hosts

The hosts file is consulted before DNS, so every process now resolves app.lab.test to loopback. Remember to remove the line when the lab is done; stale hosts entries cause confusing “works on my machine” bugs months later, when the same name gets used somewhere real.

The .test top-level domain is reserved for exactly this purpose. It will never be registered publicly, so your lab names cannot collide with a real site. That is why this course uses app.lab.test and not something ending in .com.

Which leads to the rule: do not use a public hostname you do not control for locally issued certificates. If your lab issues a certificate for someone else’s domain and the mapping leaks into a real environment, you have built a small impersonation setup. Reserved names keep the whole exercise contained.