Closed Bug 1596181 Opened 6 years ago Closed 6 years ago

Add Cloudflare CDN in front of enabled.dc.crypto.mozilla.org

Categories

(Infrastructure & Operations :: Infrastructure: Other, task)

Product:
Infrastructure & Operations
Component:
Infrastructure: Other
Type:
task
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: jcj, Unassigned)

References

Details

CryptoEng needs to have enabled.dc.crypto.mozilla.org hosted via Cloudflare, using the special certificate created in Bug 1596154, for use in the Delegated Credentials tests [1] (Bug 1580053, Bug 1574029). It must be Cloudflare.

Currently, enabled.dc.crypto.mozilla.org and dc.crypto.mozilla.org are both hosted by a small EC2 instance at ec2-3-133-81-85.us-east-2.compute.amazonaws.com. CryptoEng controls DNS for crypto.mozilla.org via Route53, and can adjust those settings as-needd.

The Cloudflare settings for enabled.dc.crypto.mozilla.org would generally be just to host the site at ec2-3-133-81-85.us-east-2.compute.amazonaws.com for enabled.dc.crypto.mozilla.org - a small test page. Full caching is great.

Using the special certificate from Bug 1596154 will do the rest. Cloudflare will automatically enable the Delegated Credentials mechanism.

[1] https://blog.mozilla.org/security/2019/11/01/validating-delegated-credentials-for-tls-in-firefox/

I've generated an SSL certificate bundle with the requirements from bug 1596154. Let me know whom I can send this to securely, and I will send it over.

Moving components - not sure if I got this one right, will ping team.

Assignee: nobody → infra
Component: Operations → Infrastructure: Other
Product: Cloud Services → Infrastructure & Operations
QA Contact: cshields
Version: unspecified → ---

:jlaz, please send me the cert you generated encrypted with the key I have published at https://keybase.io/jgmize and I will upload it to Cloudflare.
:jcj please create a CNAME record in Route53 pointing enabled.dc.crypto.mozilla.org to enabled.dc.crypto.mozilla.org.cdn.cloudflare.net

Certificate bundle sent to :jgmize over keybase

CNAME set, previous setting had a 300 second TTL so expect a fast update.

I've configured Cloudflare to use 3.133.81.85 as the origin for enabled.dc.crypto.mozilla.org, but when I attempted to upload the cert to Cloudflare I got the following error:

The private key you uploaded is invalid. Please check your input and try again. (Code: 2106)

I've emailed the Cloudflare POC for this asking for suggested next actions.

Per an email thread with our Clodflare POC we're going to try a different cert signed with ECDSA/SHA256 instead of the ECDSA/SHA384 signature used in the cert from bug 1596154. :jlaz is revoking the previous cert now and will send me the new cert once it is issued.

Old certificate has been revoked and a new one generated with the specifications in the previous comment, sent to :jgmize over keybase

It seems that Digicert is signing the certificate as SHA384, despite the fact that I am choosing SHA256. Working with Digicert to figure out the issue.

We were able to work around a bug in the Cloudflare upload form by enabling support for non-SNI legacy clients, and https://enabled.dc.crypto.mozilla.org/ is now working for me and :jcj.

Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.