title: HTTPS Spoofing in order to support legacy application
body: <p>I have a legacy application that has a hardcoded url (I don't have access to the source) in which it tries to download a file. The url takes the form:</p>
  
  <p><a href="https://pre.hostname.org/index.json" rel="nofollow noreferrer">https://pre.hostname.org/index.json</a></p>
  
  <p>but the organization that hosts that site has dropped that hostname and is using a new hostname, so that the url should be of the form:</p>
  
  <p><a href="https://hostname2.org/pre/index.json" rel="nofollow noreferrer">https://hostname2.org/pre/index.json</a></p>
  
  <p>I don't own the application source code or either website, but it occurred to me that I might be able to do some spoofing if I set up a redirect on my local webserver and point the old hostname to my webserver using the C:\windows\system32\drivers\etc\hosts file.</p>
  
  <p>On my webserver in a lighttpd conf file:</p>
  
  <pre><code>$HTTP["scheme"] == "https" {
       $HTTP["host"] =~ ".*" {
         url.redirect = ( "^/(.*)$" =&gt; "https://hostname2.org/pre$0" )
      }
  }
  </code></pre>
  
  <p>On the client machine with the legacy application in the hosts file:</p>
  
  <pre><code>0.0.0.0 hostname.org
  </code></pre>
  
  <p>(0.0.0.0 represents the hostname of my webserver with the redirect instructions)</p>
  
  <p>With this setup I can, on the client machine, access the old url in a web browser, and the redirect happens. However, it does not work from the legacy application, and I think it's due to the SSL certification hostname not matching.</p>
  
  <p>If I use Edge browser, for example, I have to workaround the warning:</p>
  
  <pre><code>The hostname in the website's security certificate differs from the website you are trying to visit.
  
  Error Code:
  DLG_FLAGS_SEC_CERT_CN_INVALID
  </code></pre>
  
  <p>I have administrator access on the client machine, the webserver, etc. I obviously trust my webserver even though it doesn't match the cert... </p>
  
  <p>I totally accept that this is as it should be -- that this is part of the protection that https and SSL certificates provide -- what I'm asking is, is there a way to cause my legacy application to ignore this situation? A way to circumvent https protection for this particular hostname / certificate system-wide, so that it will take effect for whatever API the legacy app is using to download the file through https?</p>