1106077 - Setup expired certificate for ssl-expired.mozqa.com

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: WebOps: Other, task)

Description

[Daniela Domnici]

Similary to bug 891288.

We need an expired certificate with the mozqa.com domain for the security notification test.The current domain with the invalid certificate is: "https://summitbook.mozilla.org".

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

I have to add that the certificate for summitbook.mozilla.org was expired until a couple weeks ago, until all certificate have been re-issued by IT? When we get a new expired certificate we don't want to make use of summitbook.mozilla.org anytime longer, but want to have that domain as ssl-expired.mozqa.com.

Comment 2

[C. Liang [:cyliang]]

Does the certificate need to be signed by a known issuer (like Digicert) or can it be self-signed? 

If we need a cert signed by a known issuer, I believe we still have to pay as if we are buying a 1 year cert, even if I drop the validity of the cert to 1 day.  


Created:
ssl-expired-mozqa-zlb.vips.scl3.mozilla.com  63.245.215.124

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Cyliang, I would say that we first create the subdomain (https://ssl-expired.mozqa.com/) and a self-signed certificate. We can then test how it works. If there are problems we could still buy an officially signed one.

Comment 4

[Philippe M. Chiasson (:gozer)]

This looks like some test failure, as the SSL certificate for summitbook.mozilla.org is indeed expired:

$> openssl s_client -connect summitbook.mozilla.org:443
CONNECTED(00000003)
depth=1 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=0 serialNumber = -csW8OPdwDOZBFy1pK2SKOEzx7o9IqlO, C = US, ST = California, L = Mountain View, O = Mozilla Corporation, CN = summitbook.mozilla.org
verify error:num=10:certificate has expired
notAfter=Jul  8 12:41:31 2011 GMT

Comment 5

[Andreea Matei [:AndreeaMatei]]

Philippe, we need an expired certificate with the mozqa.com domain, please see what Henrik mentioned in comment 1. Could this be done?

"When we get a new expired certificate we don't want to make use of summitbook.mozilla.org anytime longer, but want to have that domain as ssl-expired.mozqa.com."

Comment 6

[Philippe M. Chiasson (:gozer)]

(In reply to Andreea Matei [:AndreeaMatei] from comment #5)
> Philippe, we need an expired certificate with the mozqa.com domain, please
> see what Henrik mentioned in comment 1. Could this be done?
> 
> "When we get a new expired certificate we don't want to make use of
> summitbook.mozilla.org anytime longer, but want to have that domain as
> ssl-expired.mozqa.com."

I'll get on that tomorrow, it's going to be tricky to ask a CA for an expired certificate, would it be good enough if it was a self-signed certificate.

Comment 7

[Philippe M. Chiasson (:gozer)]

Allright, after some cleaning up, discovered ssl-expired.mozqa.com was used by a self-signed expired certificate, and I belive that was not good enough.

So, what you will have starting tomorrow is:

https://expired.mozqa.com/

running a perfectly valid Digicert SSL certificate, and you should be good to go.

Note, they couldn't issue certs with expiration in the past, so that's why I am talking about tomorrow, since that's when it will expire. More specifically:

Not After : Feb 25 12:00:00 2015 GMT

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to Philippe M. Chiasson (:gozer) from comment #7)
> Allright, after some cleaning up, discovered ssl-expired.mozqa.com was used
> by a self-signed expired certificate, and I belive that was not good enough.
> 
> So, what you will have starting tomorrow is:
> 
> https://expired.mozqa.com/

So why can't we continue to use ssl-expired.mozqa.com? Has the certificate not been created for that subdomain? It would break our naming schema for all types of certificate testcases we have on that domain.

Comment 9

[Shyam Mani [:fox2mike]]

Gozer,

Would it be possible to revoke expired.mozqa and get one with their old sub-domain?

Comment 10

[Shyam Mani [:fox2mike]]

:whimboo,

I'll look into this for you.

Comment 11

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Thanks a lot, Shyam!

Comment 12

[Shyam Mani [:fox2mike]]

(In reply to Henrik Skupin (:whimboo) from comment #11)
> Thanks a lot, Shyam!

Henrik,

So I have ssl-expired.mozqa.com up and running on the older certificate (which was self signed). Did you need this to be a properly signed certificate?

Comment 13

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Yes, because with a self-signed certificate there will also be an exception warning which we totally do not need. :/

Btw. I tried to load ssl-expired.mozqa.com but it's not reachable.

Comment 14

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Due to some recent changes in NSS 3.18 as shipped with Firefox 38 our current expired certificate does no longer work. Reason is that with that version older Equifax root CA certificates have been removed. So this domain has no longer a valid issuer.

Our security tests are our P1 area of Mozmill Tests, so a test for that is somewhat important. Please lets find a proper solution soon. Thanks.

Comment 15

[:Atoll]

I talked with :gozer and we just have to phone Digicert to override the requested expiration date, so I'll do that tonight.

Comment 16

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Thanks Richard! I assume this will then be for ssl-expired.mozqa.com.

Comment 17

[:Atoll]

Emailed Digicert for ssl-expired.mozqa.com:

Request #140175: Alter expiration date to 26-MAR-2015

Comment 18

[:Atoll]

The certificate was issued with an expiration date of 26-MAR-2015, and is live at https://ssl-expired.mozqa.com/. I'll wait for it to expire before decom'ing the unused https://expired.mozqa.com/ VIP.

Comment 19

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to Richard Soderberg [:atoll] from comment #18)
> The certificate was issued with an expiration date of 26-MAR-2015, and is
> live at https://ssl-expired.mozqa.com/. I'll wait for it to expire before
> decom'ing the unused https://expired.mozqa.com/ VIP.

Great! So once this cert is online we can update our tests. I will not be around before Wednesday next week. So Syd could handle the re-activation of test code for the mozmill-tests, and Chris for Firefox UI tests. Both bugs are marked as dependent on that one.

Comment 20

[:Atoll]

(Note that the cert is already online, it just won't expired for another 2 days.)

Comment 21

[Henrik Skupin [:whimboo][⌚️UTC+2]]

That's right, but our tests would fail if we enable it earlier than that date.

Richard, once Syd or Chris have proven that it works we can also get rid of the old summitbook.mozilla.org domain. AFAIK this domain only exists for our purpose. But please check back first.

Comment 22

[Shyam Mani [:fox2mike]]

I second Henrik, once this works, summitbook.mozilla.org can be decom'd.

Comment 23

[:Atoll]

It's expired correctly! Henrik, what's next on your side?

I'm going to decom 'expired.mozqa.com' in favor of this now.

Comment 24

[:Atoll]

Decom'd expired.mozqa.com, released its IP back to the DNS pool, removed vserver/trafficip/cert from Zeus.

Comment 25

[Syd Polk :sydpolk]

Does anybody know which tests I need to re-enable are?

Comment 26

[Chris Manchester (limited bugmail, email directly)]

(In reply to Syd Polk :sydpolk from comment #25)
> Does anybody know which tests I need to re-enable are?

It's the commented portion starting here: http://hg.mozilla.org/qa/mozmill-tests/file/a586f9c84047/firefox/tests/remote/testSecurity/testSecurityNotification.js#l49

Comment 27

[Chris Manchester (limited bugmail, email directly)]

I'm re-enabling the firefox-ui-test here: https://github.com/mozilla/firefox-ui-tests/pull/143

Everything looks good locally.

Comment 28

[Syd Polk :sydpolk]

The mozmill test looks fine when I re-enable it and change "summitbook.mozilla.org" to "ssl-expired.mozqa.com".

Comment 29

[:Atoll]

Yay! I'll wait a day or few and then take down summitbook (I'm presuming webops hosts it somewhere) and close out this bug.

Comment 30

[:Atoll]

So, this domain is fixed and expired correctly, and that means we can close this bug. I've filed bug 1149405 as a decom bug for summitbook and blocked it on both of the upstream bugs from this one.

Comment 31

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Thank you Richard!