1017155 - HTTPS for telemetry.mozilla.org

Status: RESOLVED FIXED

(Data Platform and Tools :: General, defect)

Description

[Jonas Finnemann Jensen (:jonasfj)]

telemetry.mozilla.org is currently hosted using S3, directly. This means not HTTPS.

Which is sort of not-so-good, because we encourage people to hotlink telemetry.js from here. Specifically, if you want to consumer aggregated telemetry data as displayed on the dashboard, then the official way to do so, is to include:
http://telemetry.mozilla.org/v1/telemetry.js 

We can probably do this by putting cloudfront in front of our S3 bucket.
It can do custom SSL certificates now.

Note. expiration for all objects under cloudfront should preferably not be 24 hours. An hour or less would be preferable. If this is something we can configure bucket wide that would be great.

Otherwise, I guess we can update our sync script to flush cloudfront when we update the S3 bucket.
The goal here is really just to mirror the github repository on telemetry.mozilla.org with HTTPS.

Comment 1

[Benson Wong [:mostlygeek]]

Note: this will use Cloudfront SNI SSL (shared IP address). This is included in the price and likely not an issue since all the clients are Firefox browser.

Comment 2

[Mark Reid [:mreid]]

(In reply to Ben Wong [:mostlygeek] from comment #1)
> Note: this will use Cloudfront SNI SSL (shared IP address). This is included
> in the price and likely not an issue since all the clients are Firefox
> browser.

There's actually a fair number of non-Firefox browsers viewing telemetry.mozilla.org, but according to the SNI SSL docs:
"SNI Custom SSL works with most modern browsers, including Chrome version 6 and later (running on Windows XP and later or OS X 10.5.7 and later), Safari version 3 and later (running on Windows Vista and later or Mac OS X 10.5.6. and later), Firefox 2.0 and later, and Internet Explorer 7 and later (running on Windows Vista and later)."

This covers the current telemetry.m.o user base (assuming it works in modern versions of Opera too).

Comment 3

[Jonas Finnemann Jensen (:jonasfj)]

We have a few people who uses telemetry.js in node.js. So I've recently created a node.js module to load telemetry.js from telemetry.m.o/v1/telemetry.js (basically to reduce maintenance). See blog post for details:
http://jonasfj.dk/blog/2014/08/using-aggregates-from-telemetry-dashboard-in-node-js/

Anyways, this npm module loads telemetry.js over HTTP. It would be really nice to get HTTPS support for telemetry.mozilla.org.

SNI perfectly okay with me, we don't care about old browsers as they can't run the content anyway :)

Comment 4

[Doug Turner (:dougt)]

next steps?

Comment 5

[Mark Reid [:mreid]]

- Create Cloudfront distribution for the "telemetry.mozilla.org" S3 bucket
- Configure custom SSL for Cloudfront using the telemetry.mozilla.org SSL Cert
- Update DNS: Switch the CNAME for telemetry.mozilla.org to point at the Cloudfront distro (it's currently pointing directly at the S3 bucket URL: telemetry.mozilla.org.s3-website-us-east-1.amazonaws.com)

Comment 6

[Benson Wong [:mostlygeek]]

Need an SSL cert (telemetry.mozilla.org) created for cloudfront. jason could you get that into the new prod iam for me please?

Comment 7

[Jason Thomas [:jason]]

Webops purchased a Multi EV SSL Certificate for telemetry.mozilla.org in bug 911309. Let's reuse this here. 

It has been uploaded to new prod IAM.

Comment 8

[Benson Wong [:mostlygeek]]

cloudfront distribution setup. 
Just need to change telemetry.mozilla.org CNAME d65ojvdli7jd8.cloudfront.net

Test it 

(SSL): 

(printf "GET / HTTP/1.1\nHost: telemetry.mozilla.org\n\n"; sleep 2) | openssl s_client -connect d65ojvdli7jd8.cloudfront.net:443 -servername telemetry.mozilla.org

(HTTP): 
curl -vH 'Host: telemetry.mozilla.org' d65ojvdli7jd8.cloudfront.net

Comment 9

[Mark Reid [:mreid]]

Filed bug 1057469 for the DNS part.