777812 - ringring's SSL certificate is no longer valid

Status: RESOLVED FIXED

(Infrastructure & Operations :: Telecom, task, P3)

Description

[Dave Miller [:justdave]]

"The certificate is not trusted because it was signed using a signature algorithm that was disabled because that algorithm is not secure."

This started with yesterday's Aurora update.

Comment 1

[Jake Maul [:jakem]]

What's the URL / domain name for this?

Comment 2

[Dave Miller [:justdave]]

ringring.mv.mozilla.com with a SAN for ringring.office.mozilla.org

Comment 3

[Dave Miller [:justdave]]

/me needs to shift-reload before commenting on bugs in restored tabs

Comment 4

[Dave Miller [:justdave]]

This is a MozillaCA cert, fwiw.

Comment 5

[Jake Maul [:jakem]]

From:

http://www.mozilla.org/en-US/firefox/16.0a2/auroranotes/

I found:

https://bugzilla.mozilla.org/show_bug.cgi?id=650355


If I'm not mistaken, the only way for us to fix this is to generate a new Mozilla CA cert.

This would also mean that every cert we have that Firefox might in some way reach is going to have this problem.

Comment 6

[Jake Maul [:jakem]]

This bug is now about replacing ringring's SSL cert with one signed by a new Mozilla CA... which I will open a new bug about creating. I don't see a good way around this, apart from simply purchasing certs and abandoning the concept of an internal CA.

Comment 7

[Jake Maul [:jakem]]

As far as I can tell this in fact does not have any SAN records on it... however since I'm replacing it anyway, the new one will. :)

* common name: ringring.office.mozilla.org (does not match 'ringring.mv.mozilla.com')

Comment 8

[Jake Maul [:jakem]]

The new cert/key is generated and signed. I don't know how to install it on this device/service however... is that something you can do?

If so, you can fetch the cert/key from ssl1.private.phx1:

/root/root-ca/ringring.office.mozilla.org.crt
/root/root-ca/ringring.office.mozilla.org.key


Moving this to Server Operations: Telecom... seems like the logical next step.

Comment 9

[Dave Miller [:justdave]]

And soon it'll be pbx1.voip.mtv1.mozilla.com...  but we're stalling on using that name for the new hardware to be put in place.

For the record, it's just apache.  Installs the same way it does on every other apache. :)

Certificate has been replaced and tested, all looks good.