1260332 - SSL certificate for sensorweb.io

Status: RESOLVED INCOMPLETE

(Infrastructure & Operations :: SSL Certificates, task)

Description

[elin]

Since we have several subdomains to secure,
e.g. apex,www,app,api,developer...
can we have a wildcard certificate for that?

Comment 1

[Eric Ziegenhorn :ericz]

:kang, does opsec want to review issuing a wildcard cert for sensorweb.io?

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

yes - using wildcard certificates is strongly discouraged and only used when there is no other solution.
@elin, what is your usage case? Could alternate subject names be ok instead of wildcard?
It sounds like SensorWeb could potentially use an RRA instead to determine this (https://wiki.mozilla.org/Security/Risk_management/Rapid_Risk_Assessment) (can request via bug https://wiki.mozilla.org/Security/OpSec#Service:_Rapid_Risk_.28Impact.29_Assessment_.28RRA.29)

Comment 3

[Eric Ziegenhorn :ericz]

Please kick off the RRA via the bug link above then we'll proceed on certs once that review is completed.

Comment 4

[:Atoll]

www.sensorweb.io resolves to ec2-52-196-14-197.ap-northeast-1.compute.amazonaws.com, so this is on a self-hosted EC2 instance. I strongly recommend using Let's Encrypt here, and Webops has approval from Mozilla Infosec to issue certs through LE for our sites.

Based on your Nginx version (1.8.1), you're running the nginx stable PPA on a modern Ubuntu host, probably 14.04 LTS. https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04 has a complete guide to configuring and running Let's Encrypt on Ubuntu 14.04, and should allow you to self-provision a certificate here (even if you're on 15, or 16 LTS).

Could you please try this and let us know if it works out for you?

Comment 5

[:Atoll]

Oh, and: Each time you want to change (Add or Remove) the domains authorized for that certificate, you would just repeat this line from the instructions:

> ./letsencrypt-auto certonly -a webroot --webroot-path=/usr/share/nginx/html -d example.com -d www.example.com

Specifying a new set of -d X -d Y parameters listing all the domains you intend to accept, and then restart Nginx once it's updated the certificate on disk.

Comment 6

[Shyam Mani [:fox2mike]]

Timeout, please re-open when there's activity. Thanks!