1206728 - https://symbols.mozilla.org/ serves an invalid TLS certificate

Status: RESOLVED WONTFIX

(Infrastructure & Operations :: SSL Certificates, task)

Description

[(no longer active)]

The certificate seems to only be valid for *.herokuapp.com, and herokuapp.com.

Comment 1

[Peter Radcliffe [:pir]]

This is apparently a socorro service, in AWS. Haven't managed to get in touch with socorro folks to confirm yet.

:lonnen, can you confirm/deny?

Comment 2

[Ryan Watson [:w0ts0n]]

Hello!

This site was moved to Heroku as per bug: 1130023

According to the old info that still needs to be decom'd:
(apache) 
domains/symbols.mozilla.org.conf"
<VirtualHost *:80>
    ServerName symbols.mozilla.org

I have also checked on the zlb itself and can see no SSL cert applied. That leads me to believe it was never listening on HTTPS.

At this point it's not possible for us to redirect https > http as termination of the SSL is done on Heroku. The only way for us to fix this problem is:
 
a) if heroku enable you to turn of SSL do that
b) we can buy an SSL cert and apply it to your heroku instance (around $150) 

Needinfo'ing rhelmer as to how to proceed.

Comment 3

[Robert Helmer [:rhelmer]]

(In reply to Ryan Watson [:w0ts0n] from comment #2)
> Hello!
> 
> This site was moved to Heroku as per bug: 1130023
> 
> According to the old info that still needs to be decom'd:
> (apache) 
> domains/symbols.mozilla.org.conf"
> <VirtualHost *:80>
>     ServerName symbols.mozilla.org
> 
> I have also checked on the zlb itself and can see no SSL cert applied. That
> leads me to believe it was never listening on HTTPS.
> 
> At this point it's not possible for us to redirect https > http as
> termination of the SSL is done on Heroku. The only way for us to fix this
> problem is:
>  
> a) if heroku enable you to turn of SSL do that
> b) we can buy an SSL cert and apply it to your heroku instance (around $150) 
> 
> Needinfo'ing rhelmer as to how to proceed.

Right, this service did not use SSL before, so we didn't have a cert to migrate.

I don't think it's possible to disable SSL on Heroku from a quick look at the docs.

Ted, do you think we should buy a cert for symbols.m.o?

Comment 4

[:Atoll]

If the service isn't intended to be published as SSL, then I don't think we care if it advertises SSL. The site will offer a cert warning for users who browse with SSL Everywhere, and that's fine. I would eventually recommend using a Let's Encrypt DV cert, once they launch, but don't see any reason to add unnecessary costs for a Digicert here.

Comment 5

[(not currently active) Ted Mielczarek]

We discussed this briefly on IRC. If we weren't historically serving this via SSL then I don't see any need to make that happen now.

Comment 6

[:Atoll]

Thanks for the updates, all. Closing this with no action to take.