1030731 - irc.allizom.org uses very bogus SSL certificate

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: Infrastructure: IRC, task)

Description

[Gervase Markham [:gerv]]

I've not seen so many errors in one cert for a while :-)

irc.allizom.org:6697 uses an invalid security certificate. 
The certificate is not trusted because it is self-signed. 
The certificate is only valid for irctest.allizom.org 
The certificate expired on 12/06/14 00:13. The current time is 26/06/14 14:01.

Instantbird will not connect to the server for this reason, and I don't see override UI (which is maybe a good thing).

We need a proper cert chaining up to a publicly trusted root, for the correct domain name, and which is not expired. :-)

Gerv

Comment 1

[Dan Parsons [:lerxst]]

I can fix up most of this but definitely not getting a signed SSL cert for the testing phase. It's just not necessary.

Comment 2

[Gervase Markham [:gerv]]

Well, IB won't connect at all if it doesn't trust the cert. If it's self-signed, can you put it up for download somewhere with its fingerprint so people can add it to the IB (or other client) trust store?

Gerv

Comment 3

[:Atoll]

(In reply to Dan Parsons [:lerxst] from comment #1)
> I can fix up most of this but definitely not getting a signed SSL cert for
> the testing phase. It's just not necessary.

Would a Mozilla CA signed certificate be acceptable?

(In reply to Gervase Markham [:gerv] from comment #2)
> Well, IB won't connect at all if it doesn't trust the cert. If it's
> self-signed, can you put it up for download somewhere with its fingerprint
> so people can add it to the IB (or other client) trust store?

You can download it with:

echo -n | openssl s_client -connect HOST:PORT | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > HOST:PORT.crt

Comment 4

[Dan Parsons [:lerxst]]

Apparently we already have a cert for *.allizom.org. Getting my hands on it now and will have it configured into the irc servers soon.

Comment 5

[Dan Parsons [:lerxst]]

OK, I've got the *.allizom.org cert in all 3 servers now. :gerv, can you test and see if your ssl problems are gone now?

Comment 6

[Gervase Markham [:gerv]]

Yes, this now works. Thank you :-)

Gerv