1156256 - download.mozilla.org:HTTPS - SSL Cert expiration on 05/05/2015 12:00

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Description

[Peter Radcliffe [:pir]]

Mon 05:22:14 PDT [1063] 
  download.mozilla.org:HTTPS - SSL Cert expiration is WARNING: WARNING - 
  Certificate download.mozilla.org expires in 14 day(s) (05/05/2015 12:00). 
  (http://m.mozilla.org/HTTPS+-+SSL+Cert+expiration)

Comment 1

[:Atoll]

Does this domain require a SHA-1 certificate or have cert pinning requirements?

Comment 2

[[e-mail] (:bhearsum)]

There's no pinning requirements on download.mozilla.org that I'm aware of. Any valid SSL cert should be fine.

Comment 3

[:Atoll]

Renewal requested submitted in portal with expiration 29-DEC-2016 and emailed Digicert support to force it as a SHA1 renewal.

Comment 4

[Nick Thomas [:nthomas] (UTC+12)]

I checked with rstrong regarding the stub installer on windows, and it makes an http request to download.m.o so there's no issue there.

Comment 5

[:Atoll]

This bug does not require infra-lock.

Comment 6

[Robert Strong (they/them - no direct email)]

Kamil and Marcia, if either of you can verify that the stub installer still works after this change it would be appreciated. It is my understanding that this will be happening very soon.

Comment 7

[:Atoll]

The new certificate is issued and available to install on the server. I'll wait until tomorrow morning before doing this, to try and coordinate testing with Kamil/Marcia.

Comment 8

[:Atoll]

SHA-1 cert deployed to PHX1 and SCL3 external zeus clusters.

Comment 9

[Marcia Knous [:marcia]]

Robert/Richard: Now that I am a QA community manager, I am not actively testing Desktop. Can you please work with Kamil regarding this request? Thanks.

Comment 10

[:Atoll]

Sure thing.

Comment 11

[Kamil Jozwiak [:kjozwiak]]

- Win XP Pro SP2 x86: PASSED
- Win XP Pro SP3 x86: PASSED
- Win XP Pro SP2 x64: PASSED

Went through the following test cases twice using each of the OS's listed above:

* Using IE8, visited https://download.mozilla.org without getting any certificate issues/warnings
** clicked on "Compatibility View" and the certificate window appeared green without any issues
** I had to use IE6 on SP2 x86 because that VM instance isn't fully update (but the lock appeared at the bottom indicating that the connection is secure without any errors/warnings)

* Downloaded the stub installer via https://download.mozilla.org (re-directed to https://www.mozilla.org/en-US/firefox/new/)
** downloaded and installed FX using the "Firefox Setup Stub 37.0.2.exe" installer without any issues
** launched fx without any issues (visited duckduckgo, facebook, twitter to make sure things were working)

Let me know if this looks good Richard!

Comment 12

[:Atoll]

That's what I needed to know. Thank you! This is great. IE6 on SP2 x86 is precisely what we needed testing of, so please keep that VM! :)

Comment 13

[Gervase Markham [:gerv]]

This renewal with a date in 2016 means that download.mozilla.org now gives an SSL warning (yellow triangle on the lock icon) in stable Chrome. Is it worth reopening this and getting a new cert for 2015? See also bug 1064387.

Gerv

Comment 14

[:Atoll]

(In reply to Gervase Markham [:gerv] from comment #13)
> This renewal with a date in 2016 means that download.mozilla.org now gives
> an SSL warning (yellow triangle on the lock icon) in stable Chrome. Is it
> worth reopening this and getting a new cert for 2015? See also bug 1064387.

This needs to be filed as a new bug, but I absolutely agree that we should reconsider the DEC 2016 termination date for SHA-1 support.