272434 - Update Beta site does not work under https

Status: VERIFIED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[alanjstr]

If I go to https://update-beta.mozilla.org, I see the current update site, not
the beta.  Going to http://update-beta.mozilla.org shows the new site.  This
means that communications to the site, including the webservice and login are
not secured.

Comment 1

[Wolf [:wolf]]

Considering it's developmental only, that's mostly intentional. I only
configured update-beta/update to be vhosted on 80 originally, as to not disturb
443, which is now behind squid. (80 isn't) (As there's also not a cert for
update-beta, which doesn't seem like something that's required.)

No clients that aren't aware of the dev nature of update-beta should be talking
to its webservice.

Comment 2

[alanjstr]

The cert says that there are multiple names on it, update.mozilla.org and
iguana.mozilla.org, the latter redirecting to UMO.  

Just because it is a development server, if you intend to have any sort of
public beta, I think it should be secure.  But hey, since I have an admin
account, if I get compromised it won't matter, right?

Comment 3

[Wolf [:wolf]]

I should add, that there's no reason why u-b shouldn't be configured for both,
but it wouldn't be a priority. I didn't originally as I didnt want to risk
breaking the apache config for 443, where most of the Firefox users would hit. :-)

Comment 4

[alanjstr]

Could we do https://update-beta.mozilla.org:8443 instead?

Comment 5

[Wolf [:wolf]]

Somebody could. not me. :-) and that's an ugly port #..

I'm leaving this up to server ops to do whatever they feel is best.

Comment 6

[Dave Miller [:justdave]]

This is done.  I ran accross it the other day and fixed it because I noticed. :)

Because a lot of the recent problems with update (changing back to windows when
going to the next page with another OS selected?) are likely cache related,
having it behind squid for testing will probably be useful anyway.

https://update-beta.mozilla.org/

Comment 7

[Wolf [:wolf]]

Thanks Justdave. :-)

Comment 8

[alanjstr]

Ok, but it doesn't automatically redirect you to https.

Comment 9

[alanjstr]

https://update.mozilla.org/admin/ is still protected by http-auth, which means
you have to pass through that before getting redirected.  Can the http-auth be
turned off for those who have old bookmarks (all three of us)

Comment 10

[Wolf [:wolf]]

The redirection isn't part of the server config. but a script-side hack,
therefore the http auth provides extra protection for the scripts, just as it
always has. I don't want the auth disabled for /admin/ until migration is complete.

Comment 11

[Dave Miller [:justdave]]

port 80 now globally redirects to port 443.

Comment 12

[Wolf [:wolf]]

OK, thanks. :-)