1022796 - SSL certificate for *.taskcluster.net

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Description

[Jonas Finnemann Jensen (:jonasfj)]

I hope this is the right place to file for a wildcard certificate.

We have CNAMEd various applications to *.taskcluster.net subdomains, so a wildcard certificate is necessary.

We're currently hosting all taskcluster components on heroku (and intend to do so for the time being). I believe we can use a single SSL end-point there, and all I need to do is upload a certificate.

We might also have a single EC2 node that sits on a taskcluster.net subdomain.
But I'll look into configuring that later, if we can't move it to heroku.

Comment 1

[Philippe M. Chiasson (:gozer)]

Digicert request made: 20-JUN-2014 1:01 PM

Comment 2

[Philippe M. Chiasson (:gozer)]

-----BEGIN CERTIFICATE REQUEST-----
MIIDCDCCAfACAQAwgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBv
cmF0aW9uMRowGAYDVQQLExFTZWN1cmUgV2ViIFNlcnZlcjEaMBgGA1UEAxQRKi50
YXNrY2x1c3Rlci5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDe
XAMT33gujCTcbnndQAQHFv69A9j4JDZhUpWs8ibwj/nztSVWhV1CREKaAF0jgjdc
OZi54ZbhDhCVpgZAdK3GujcWktU1dhK5/R0JsL2AoQp6JXxopQ9sM8fwyppzQXfs
sVGqid7Ijfyp05C0ebdNfGy2yaDrsZThwYd/VJX+t0ttzACGOYzcjik0d74c0JJr
c+/Jsu3kEiMq1L9WrUWJ9+np/XJMZQ1WKIfMm1AYAJ3xL1wjkK0wcEdbH9t2P9v3
H9f7UZ0FdA8wZ9yvccXrR9ggv0jfgQ+Ii7r1F4mL7FHUZ1v/kEKDyV1IQeCqrY3j
p9FV96Eyy9wbjVSijCmzAgMBAAGgMjAwBgkqhkiG9w0BCQ4xIzAhMBEGCWCGSAGG
+EIBAQQEAwIGQDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBQUAA4IBAQCF+pJ+
F8D/evVsAVfWiT5+CD1+9m2QKUxAgJm2DphRp2HO2zXd6RdpNJ/q52XVGkY3M/wX
2yyZmA4W6oQ6k4CEB8FS7hHKTobF14aIUdxTBQ3celi03iHydkNcFVaAxo2Mwi0v
leYMJ4mCzugeOZjnq3kbO7DRkto32pzN5iAf6egwHlr2I+3nuSHFBUocpRtslVd3
uAihQqItNTESyEktejHLaLa4F/beyM/mOUzb/JSvFd1ZSEozvXTLkinhtcenEba0
O1S/ZgbSw6w/v9XMS3DYl51PZtgWdWOAWyA0GbshPPL8WhZwNjMgJHtZBLlnL4qp
Jx1RhDIgAIZhnFxd
-----END CERTIFICATE REQUEST-----

Comment 3

[Philippe M. Chiasson (:gozer)]

-----BEGIN CERTIFICATE-----
MIIFJDCCBAygAwIBAgIQBJxqG2ORBisIz/pDgOH+1TANBgkqhkiG9w0BAQsFADBN
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTQwNjIxMDAwMDAwWhcN
MTUwNjI2MTIwMDAwWjBsMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNV
BAcTDU1vdW50YWluIFZpZXcxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24x
GjAYBgNVBAMMESoudGFza2NsdXN0ZXIubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEA3lwDE994Lowk3G553UAEBxb+vQPY+CQ2YVKVrPIm8I/587Ul
VoVdQkRCmgBdI4I3XDmYueGW4Q4QlaYGQHStxro3FpLVNXYSuf0dCbC9gKEKeiV8
aKUPbDPH8Mqac0F37LFRqoneyI38qdOQtHm3TXxstsmg67GU4cGHf1SV/rdLbcwA
hjmM3I4pNHe+HNCSa3PvybLt5BIjKtS/Vq1Fiffp6f1yTGUNViiHzJtQGACd8S9c
I5CtMHBHWx/bdj/b9x/X+1GdBXQPMGfcr3HF60fYIL9I34EPiIu69ReJi+xR1Gdb
/5BCg8ldSEHgqq2N46fRVfehMsvcG41UoowpswIDAQABo4IB3zCCAdswHwYDVR0j
BBgwFoAUD4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0OBBYEFJHZR9rmJ+0eTxA5
BRRDtestcPDGMC0GA1UdEQQmMCSCESoudGFza2NsdXN0ZXIubmV0gg90YXNrY2x1
c3Rlci5uZXQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
BgEFBQcDAjBrBgNVHR8EZDBiMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5j
b20vc3NjYS1zaGEyLWcyLmNybDAvoC2gK4YpaHR0cDovL2NybDQuZGlnaWNlcnQu
Y29tL3NzY2Etc2hhMi1nMi5jcmwwQgYDVR0gBDswOTA3BglghkgBhv1sAQEwKjAo
BggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzB8BggrBgEF
BQcBAQRwMG4wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBG
BggrBgEFBQcwAoY6aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0
U0hBMlNlY3VyZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEB
CwUAA4IBAQAdxtv7E8g0jYpi2ns6bfKw5oLE7B9s8r7lqGmVcID374BltPywNPpb
6/naIgOy203rq/+T00zScazjc8IGKVClUfkDjUJbYuTTkONG1UsvxjrylvWLk++k
BVpnQztXzN/biQC9L3wkG377zXN9JR7yOSpgqN0Xak5zC0v5Iu0oP/wAiYf/TihD
+Mmw2F8d+jzCIO1oxrh3KMw9RIof0zxvSdPOqhL92Ob+LWchBfV4tUxntIA5XUg9
h40hsYbvCdfJPCe45PjfQOn9bGxnzrg22T5lnD1Qt7f5/HakpmPvNcaMtiKZpkwi
Y+K2uxMChFsSSc1ch2XnWD72YjKf03ke
-----END CERTIFICATE-----

Comment 4

[Philippe M. Chiasson (:gozer)]

Before I can send you the private key, I'll need a GPG key for <[e-mail]>

Comment 5

[Jonas Finnemann Jensen (:jonasfj)]

Attachment: jojensen.gpg

I think this is a GPG public key and with some luck I should be able to decrypt messages sent to it.
But please don't throw away your copy of the private certificate key before I've verified that I got it right :)

Comment 6

[Philippe M. Chiasson (:gozer)]

Key and Certificates delivered via GPG encrtpyed mail. Enjoy.