986712 - public-facing test server for working on mozilla::pkix

Status: RESOLVED WORKSFORME

(Infrastructure & Operations :: IT-Managed Tools, task)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

We're working on a new certificate verification library (mozilla::pkix - see bug 915930, etc.) and it would be really useful to have a public-facing test server where we could try out various ssl certificates. A small VM with nginx, openssl, and maybe node would be about what we need, I imagine.

Comment 1

[Jason Crowe [:jd]]

We discussed this yesterday and we can use Apache if that is quicker to deploy. There is no app / site requirement (hello world is sufficient). Devs require either root access or a method of updating the certs. Due to this requirement we cannot offload SSL to Zeus, we can either do a ZLB pass through of 443 or open a netflow to allow external connections to this VM over port 443. I will needinfo :ulfr for an opinion on this.

Requirements will be one tiny VM with some sort of SSL serving capability and dev access to swap out certs. Should be quick and simple as there are no external dependencies.

Cheers

Comment 2

[Julien Vehent]

This has no risk factor, so we can go with whatever is most convenient. My guess is that :keeler wants as many test endpoints as possible, so it would be easier to take a public IP, and route all traffic to a given VM for a given port range.

:keeler, what do you want the tests to focus on? If it's only cert parsing, then Apache will do. If you want other SSL stacks, with HEAD OpenSSL for example, then we can build something custom for you.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Yes, the focus is user-agent certificate parsing and validation, so Apache should do fine. Thanks!

Comment 4

[Chris Turra [:cturra]]

i think this would be a great use for Amazon EC2 instances. since the environments you need are basically ephemeral, i believe it would be the perfect place to do this work. additionally, this route would have no requirement for IT involvement, so you would be able to work at your own pace.

Comment 5

[Jason Crowe [:jd]]

Hi,

Any opinion on the suggestion from chris in comment 4? Would you like us to help you get going in that direction or is there a reason you do not wish to take that route?

Thanks

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Sorry - I've been on vacation. An Amazon EC2 instance would be perfect.
Thanks!

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

This got resolved.