981913 - Renew lists.bugzilla.org SSL certificate with DigiCert

Status: RESOLVED FIXED

(Infrastructure & Operations :: SSL Certificates, task)

Description

[Brandon Burton [:solarce]]

Renew lists.bugzilla.org SSL certificate with DigiCert, expires 2014-05-14

Comment 1

[Brandon Burton [:solarce]]

* Gonna see if we can move the NAT and SSL termination to Zeus
* Gonna see if it makes sense to make a SAN with other mailman certificates

Comment 2

[Dave Miller [:justdave]]

(In reply to Brandon Burton [:solarce] from comment #1)
> * Gonna see if it makes sense to make a SAN with other mailman certificates

What do you mean by SAN in this context?  I'm not sure what that has to do with a certificate...

Comment 3

[Dave Miller [:justdave]]

Er, nevermind, SubjectAltName, not Storage blah blah....   yeah, sounds fine to me.

Comment 4

[Dave Miller [:justdave]]

Although the one thing to consider is the lists.bugzilla.org mailman box also has a couple CGI scripts running on it that are on http://bugzilla.org/ (no www., no lists.)  Anything outside of /cgi-bin/ redirects to www.

Comment 5

[Brandon Burton [:solarce]]

After chatting with :limed on irc, we're going to leave as is, as the current config keeps mail delivery simple

I'll renew through digicert and :limed will get managed by Puppet

Comment 6

[Brandon Burton [:solarce]]

Order: https://www.digicert.com/enterprise/order-details.php?order_id=00507456

Certificate:

-----BEGIN CERTIFICATE-----
MIIFFDCCA/ygAwIBAgIQB6jyhLt3kt9J3GjDkHQhQjANBgkqhkiG9w0BAQsFADBN
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTQwNDE3MDAwMDAwWhcN
MTcwNDIxMTIwMDAwWjBsMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNV
BAcTDU1vdW50YWluIFZpZXcxGzAZBgNVBAoTEk1vemlsbGEgRm91bmRhdGlvbjEb
MBkGA1UEAxMSbGlzdHMuYnVnemlsbGEub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAyKv1J0nPw33uQOf8Uc3Jepd+hI3dZALz9tCWZCUEPdOZPQn4
TCIIoub1+pzhFUNX/iFeA16IpSn7hiz1Bph38yeJGObIAfXNLayfUQ/A+WMYaMt/
y0mbNRDip+DyYrxnl35r6MOYX8cnlNpWYjAqXgbpsYVK1lKlxFVqU1Ajn0aOZQAP
WD66pc6GJr6W746EWBkmF7CS5E8iwMDdKf+EaXqRlcdqalp2Y2zFgDEi5hd81BqE
hVvrZi2VQlaxKeNEhjdEzYCU/Jl60B2jsO5Z7QKnQ/vvn94PEB2nP2Vf6DdzAwEd
HyRumeDCjIL8xTcGbkZEeZOWR+WUyxxT21Ct1QIDAQABo4IBzzCCAcswHwYDVR0j
BBgwFoAUD4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0OBBYEFKTCj6sQspTYwtfh
YQ8F/RrgkBGLMB0GA1UdEQQWMBSCEmxpc3RzLmJ1Z3ppbGxhLm9yZzAOBgNVHQ8B
Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGsGA1UdHwRk
MGIwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zc2NhLXNoYTItZzEu
Y3JsMC+gLaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWcx
LmNybDBCBgNVHSAEOzA5MDcGCWCGSAGG/WwBATAqMCgGCCsGAQUFBwIBFhxodHRw
czovL3d3dy5kaWdpY2VydC5jb20vQ1BTMHwGCCsGAQUFBwEBBHAwbjAkBggrBgEF
BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEYGCCsGAQUFBzAChjpodHRw
Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRTSEEyU2VjdXJlU2VydmVy
Q0EuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAAr2A/AymMJF
LDjz42SEESGtvyxNgv4w930mCMcqC0wUjiG7b0lrgy7pmqrXUaC1lsgViP8Lj8aG
FJ+Td+Ur1nDAtedqrkoz7NWpY/8dXGBh4Q4tlX8W35CiVWCujfitfxryWe/lbOg/
6F6/UuaEIL0xJzj9VT9CScQ0rjMQazBIdz3TZfHDc1a2RxaVcPscfpSbe8+6I6CT
6/N7qtkAOLSt6AaAwJGZ7bjkuer6Uo5giQv5PXBsV1QcXYld5M/7ZD32q4zV//Y9
BlWkltcSj8PgXITd/+uTln2OX9BOZZUizlOaBY5WfJRJSzGuQQZq6pMNhU0BDAt0
mBABSmBp1+E=
-----END CERTIFICATE-----

Comment 7

[Brandon Burton [:solarce]]

Intermediate:

-----BEGIN CERTIFICATE-----
MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg
U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83
nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd
KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f
/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX
kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0
/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C
AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY
aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6
Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1
oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD
QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v
d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh
xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB
CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl
5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA
8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC
2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit
c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0
j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz
-----END CERTIFICATE-----

Comment 8

[Brandon Burton [:solarce]]

CSR: -----BEGIN CERTIFICATE REQUEST-----
MIIC/TCCAeUCAQAwgbcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBv
cmF0aW9uMRkwFwYDVQQLExBCdWd6aWxsYSBQcm9qZWN0MRswGQYDVQQDExJsaXN0
cy5idWd6aWxsYS5vcmcxJTAjBgkqhkiG9w0BCQEWFmhvc3RtYXN0ZXJAbW96aWxs
YS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIq/UnSc/Dfe5A
5/xRzcl6l36Ejd1kAvP20JZkJQQ905k9CfhMIgii5vX6nOEVQ1f+IV4DXoilKfuG
LPUGmHfzJ4kY5sgB9c0trJ9RD8D5Yxhoy3/LSZs1EOKn4PJivGeXfmvow5hfxyeU
2lZiMCpeBumxhUrWUqXEVWpTUCOfRo5lAA9YPrqlzoYmvpbvjoRYGSYXsJLkTyLA
wN0p/4RpepGVx2pqWnZjbMWAMSLmF3zUGoSFW+tmLZVCVrEp40SGN0TNgJT8mXrQ
HaOw7lntAqdD+++f3g8QHac/ZV/oN3MDAR0fJG6Z4MKMgvzFNwZuRkR5k5ZH5ZTL
HFPbUK3VAgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEABmh7JIHN0/V72a2LyEEg
P4AYnEspR8yPRuQBjf/LTgZgf03o5Y7K9PNJAZE7qAOowD/4/WdLfDZGA/UY+6FQ
bRjmeV9YzDVTR1ggyfqcjb2GNAFc4nYHVNNI568l/4busVgN8qQgHxJCpWF7wfYG
it5tg4nLxF+xfQk0l+IK4eLPqqJo8souFS5Ct06b325TXL/ce9Fd6NlZBl4RH9ah
kFOOjExqQMB/foeWWE7Cl1l8rrr/fj6JCZTy+Nygt2SMV6Kc/S4/7KR7YlFY4b+0
rZD022l7SL1xA/S0Yoc1DzptoRzSTKV6YPiQkfwu+yq/ov7BfZzr6rBDuf4zXLRm
Vw==
-----END CERTIFICATE REQUEST-----

Comment 9

[Brandon Burton [:solarce]]

Certificate copied to ssl1, where the private key is

Comment 10

[Ed Lim [:limed]]

Just to verify and confirm the CN of the current cert is just lists.bugzilla.org so I think we should keep it as is for now.

Comment 11

[Ed Lim [:limed]]

Completed

limed@kaylee:~$ echo -n | openssl s_client -connect lists.bugzilla.org:443 2> /dev/null  | openssl x509 -noout -dates -issuer -subject
notBefore=Apr 17 00:00:00 2014 GMT
notAfter=Apr 21 12:00:00 2017 GMT
issuer= /C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA
subject= /C=US/ST=CA/L=Mountain View/O=Mozilla Foundation/CN=lists.bugzilla.org