1362568 - WARNING - treeherder.mozilla.org SSL Cert Expires 6-1-17

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Comment 1

[Kendall Libby [:fubar] (he/him)]

CC Ed; this is hosted in Heroku.

Comment 2

[Ed Morley [:emorley]]

I'm inclined to try out Heroku's automatic let's encrypt based service, ACM:
https://devcenter.heroku.com/articles/automated-certificate-management#migrating-from-heroku-ssl-with-your-own-certificate

I'll try with stage first, soon.

Comment 3

[:Atoll]

Please let us know how it goes; there shouldn't be any obstacles.

Comment 4

[Ed Morley [:emorley]]

I've filed a treeherder component bug (bug 1363814) for converting Treeherder stage and prod to Heroku ACM.

Stage is now switched (pretty slick process - am impressed), will wait a bit before doing prod to stagger the expiry date in case of issues when the auto-renewal comes up in 90 days.

Comment 5

[Ed Morley [:emorley]]

Prod now switched over to the new cert in bug 1363814.

$ heroku certs:auto --app treeherder-prod
=== Automatic Certificate Management is enabled on treeherder-prod

Certificate details:
Common Name(s): treeherder.mozilla.org
Expires At:     2017-08-09 20:25 UTC
Issuer:         /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
Starts At:      2017-05-11 20:25 UTC
Subject:        /CN=treeherder.mozilla.org
SSL certificate is verified by a root authority.

Domain                  Status
──────────────────────  ──────
treeherder.mozilla.org  OK