1205728 - [Mozilla.cz] HTTPS for mozilla.cz and start.mozilla.cz

Status: RESOLVED FIXED

(Community Building :: cs / Czech, task)

Description

[Michal Stanke (Mozilla.cz) [:mstanke][:MikkCZ]]

Let's Encrypt could be the CA once publicly available.

Other subdomains can follow.

Comment 1

[Michal Stanke (Mozilla.cz) [:mstanke][:MikkCZ]]

I asked our hosting about Let's Encrypt support. The answered they will support it in the future, but currently do not have any roadmap for it. Anyway until the end of this year, we should at least enable HTTPS beside HTTP.

Comment 2

[Michal Stanke (Mozilla.cz) [:mstanke][:MikkCZ]]

Well, Let's Encrypt public beta has been postponed to Dec 3, 2015, so I don't think Let's Encrypt will be available on our hosting in Q1 2016 at best, depending on how much Let's Encrypt gets delayed.

Comment 3

[Michal Stanke (Mozilla.cz) [:mstanke][:MikkCZ]]

Forum.mozilla.cz is being migrated to SUMO (bug 1248168), so this is just about www.mozilla.cz (and maybe start.mozilla.cz for SeaMonkey).

Let's check with the hosting, what is the ETA of Let's Encrypt support (and get a self-signed certificate for administration as a temporary hotfix).

Comment 4

[Michal Stanke (Mozilla.cz) [:mstanke][:MikkCZ]]

Hosting-signed certificate for mozilla.cz administration access has been issued and set up today.

Comment 5

[Michal Stanke (Mozilla.cz) [:mstanke][:MikkCZ]]

Let's Encrypt certs are issued for mozilla.cz and all our subdomains. Now I need to verify that everything works over HTTPS as expected and make it default eventually.

Comment 6

[Michal Stanke (Mozilla.cz) [:mstanke][:MikkCZ]]

I have set HTTPS as default for start.mozilla.cz and forum.mozilla.cz, including HSTS and CSP to improve Observatory score as possible without code changes. See https://github.com/MozillaCZ/start-mozilla-cz/issues/18.