913657 - people.mozilla.org uses SSL cert for people.mozilla.com

Status: VERIFIED FIXED

(Infrastructure & Operations :: IT-Managed Tools, task)

Description

[Ralph Giles (:rillian)]

http://people.mozilla.com/ is also available as http://people.mozilla.org/ which I find more natural to type. Unfortunately the server uses the people.mozilla.com SSL cert for both domains, resulting in a security warning when accessed over https.

I'd like to be able to use https://people.mozilla.org/ instead of http://people.mozilla.org/

Comment 1

[Justin Dow [:jabba]]

@webops - would it be possible to get a SAN cert for people.mozilla.org/people.mozilla.com ?

Comment 2

[Chris Turra [:cturra]]

it would be significantly less expensive for us to redirect requests from people.mozilla.org to people.mozilla.com to solve this :) :rillian - would you be okay with that solution?

Comment 3

[Ralph Giles (:rillian)]

The BOFH sol'n eh?

That would be better than the current situation, but I still prefer people.mozilla.org. Can we redirect the other way? people.m.o should be available to Mozillians in general, not just moco.

Comment 4

[Chris Turra [:cturra]]

thinking this through further, my proposed "solution" won't actually work. the ssl handshake will be established long before redirects happen, so the ssl error will still occur. 

as a result, :jabba's suggestion is probably the correct one.

Comment 5

[Jake Maul [:jakem]]

I'm okay with this. SAN with both records, but additionally let's make people.mozilla.com a 301 redirect to people.mozilla.org. In the future we can consider going back to a normal (non-SAN) cert for people.mozilla.org, and .com will just not have SSL anymore (at which point hopefully nobody would care and we could save some $$).

Comment 6

[Chris Turra [:cturra]]

i have to put this on hold while i chat with our certificate authority to see if we can actually have a SAN for these domains. the problem i believe we're going to run into is: mozilla.com is registered to mozilla corporation and mozilla.org is registered to mozilla foundation.

Comment 7

[Ralph Giles (:rillian)]

Could we use separate single-domain certs for each site?

Comment 8

[Chris Turra [:cturra]]

(In reply to Ralph Giles (:rillian) from comment #7)
> Could we use separate single-domain certs for each site?

yes, but that's even more expense than a SAN. if i hear back from our CA that a SAN is not possible here, that's the route i plan on taking.

Comment 9

[Jake Maul [:jakem]]

Also with 2 certs, we have to rely on either 1) getting an extra public IP (which in the case of "people" is more annoying than usual), or 2) banking on TLS SNI ... which "mostly" works, but definitely does fail sometimes.

Neither is a deal-breaker, but a SAN is definitely easier if we can do it. :)

Comment 10

[Shyam Mani [:fox2mike]]

(In reply to Chris Turra [:cturra] from comment #6)
> i have to put this on hold while i chat with our certificate authority to
> see if we can actually have a SAN for these domains. the problem i believe
> we're going to run into is: mozilla.com is registered to mozilla corporation
> and mozilla.org is registered to mozilla foundation.

Just a note here, if we move mozilla.org away from the foundation...the EV certs might run into issues, since they were issued to the foundation.

Comment 11

[Chris Turra [:cturra]]

i was able to get a SAN cert for .org and .com and have setup the redirects as suggested by :jakem in comment 5.

$ curl -I3L https://people.mozilla.com/\~cturra/
HTTP/1.1 301 Moved Permanently
Date: Mon, 09 Sep 2013 19:36:12 GMT
Server: Apache
X-Backend-Server: people1.dmz.scl3.mozilla.com
Location: https://people.mozilla.org/~cturra/
Content-Type: text/html; charset=iso-8859-1

HTTP/1.1 200 OK
Date: Mon, 09 Sep 2013 19:36:12 GMT
Server: Apache
X-Backend-Server: people1.dmz.scl3.mozilla.com
Last-Modified: Tue, 20 Aug 2013 23:27:15 GMT
ETag: "97"
Accept-Ranges: bytes
Content-Length: 151
Content-Type: text/html; charset=UTF-8



$ curl -IL http://people.mozilla.com/\~cturra/
HTTP/1.1 301 Moved Permanently
Date: Mon, 09 Sep 2013 19:36:26 GMT
Server: Apache
X-Backend-Server: people1.dmz.scl3.mozilla.com
Location: http://people.mozilla.org/~cturra/
Content-Type: text/html; charset=iso-8859-1

HTTP/1.1 200 OK
Date: Mon, 09 Sep 2013 19:36:26 GMT
Server: Apache
X-Backend-Server: people1.dmz.scl3.mozilla.com
Last-Modified: Tue, 20 Aug 2013 23:27:15 GMT
ETag: "97"
Accept-Ranges: bytes
Content-Length: 151
Content-Type: text/html; charset=UTF-8

Comment 12

[Ralph Giles (:rillian)]

Looks good. Thanks!