fr.wikipedia.beta.wmflabs.org uses an invalid security certificate
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Keegan
	Feb 26 2018, 5:57 PM

Description

fr.wikipedia.beta.wmflabs.org is not on the security certificate, serving an SSL_ERROR_BAD_CERT_DOMAIN

Raw error text:

https://fr.wikipedia.beta.wmflabs.org/wiki/Main_Page

Unable to communicate securely with peer: requested domain name does not match the server’s certificate.

HTTP Strict Transport Security: false
HTTP Public Key Pinning: false

Certificate chain:

Details

	Subject	Repo	Branch	Lines +/-
	deployment-prep: set profile::cache::kafka::webrequest::kafka_cluster_name	operations/puppet	production	+2 -0
	beta: add fr.wikipedia for LE cert	operations/puppet	production	+1 -0

Customize query in gerrit

Related Objects

Mentioned In: T166290: Provide a version of frwiki on Beta Cluster / staging
Mentioned Here: T182927: Get letsencrypt wildcard cert for *.beta.wmflabs.org domains

Event Timeline

Keegan created this task.Feb 26 2018, 5:57 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 26 2018, 5:57 PM

greg added a project: Beta-Cluster-Infrastructure.Feb 26 2018, 6:02 PM

Looks like it wasn't added to the list of let's encrypt domains.

Change 414730 had a related patch set uploaded (by Greg Grossmeier; owner: Greg Grossmeier):
[operations/puppet@production] beta: add fr.wikipedia for LE cert

https://gerrit.wikimedia.org/r/414730

gerritbot added a project: Patch-For-Review.Feb 26 2018, 6:11 PM

greg claimed this task.Feb 26 2018, 6:17 PM

greg triaged this task as High priority.

greg moved this task from To Triage to Backlog on the Beta-Cluster-Infrastructure board.

Restricted Application added projects: User-greg, Release-Engineering-Team (Kanban). · View Herald TranscriptFeb 26 2018, 6:17 PM

greg moved this task from Backlog to Blocked (externally) on the Release-Engineering-Team (Kanban) board.Feb 26 2018, 6:18 PM

greg moved this task from Backlog to Needs Review / Blocked / Waiting on the User-greg board.

Change 414730 merged by Dzahn:
[operations/puppet@production] beta: add fr.wikipedia for LE cert

https://gerrit.wikimedia.org/r/414730

Mentioned in SAL (#wikimedia-releng) [2018-02-26T18:39:13Z] <mutante> deployment-cache-text04 - manually creating Letsencrypt SSL cert for fr.wikipedia.beta.wmflabs.org (acme-setup -i "fr_wikipedia_beta_wmflabs_org" -s "fr.wikipedia.beta.wmflabs.org" --key-user root --key-group root), restarted nginx (T188288)

13:39 < mutante> ..but .. it did not fix it yet, heh
13:40 < mutante> i see, what i did is create a new cert for just the missing one
13:40 < mutante> but usually they are all added to a single unified one

back to fixing the unrelated puppet error we see on deployment-cache-text04 which prevents puppet from doing that the right way

Change 414738 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] deployment-prep: set profile::cache::kafka::webrequest::kafka_cluster_name

https://gerrit.wikimedia.org/r/414738

Change 414738 merged by Dzahn:
[operations/puppet@production] deployment-prep: set profile::cache::kafka::webrequest::kafka_cluster_name

https://gerrit.wikimedia.org/r/414738

This changed the puppet error to a new one, since now there is a kafka_cluster_name but no kafka_config for this cluster is found.

The puppet errors are fixed and fr.wikipedia.beta.wmflabs.org seems to now be part of the unified cert. Thus I'm closing this as resolved.

However, there is no database frwiki in beta and no wiki is configured for fr.wikipedia.beta.wmflabs.org. It resolves only because we happen to use a wildcard dns *.beta.wmflabs.org. I assume noone checked that and instead just went ahead trying to fix the issue at hand. Thanks for that, but future tasks to add domains to the ASNs of the beta letsencrypt cert should be closed as Invalid if that domain just points to the "Nothing configured here" page. There's no way we can get all these unconfigured domains int the ASN of our cert (as a single entry per domain).

The preferred solution to this is to get a wildcard certificate from letsencrypt. That's a tracked at T182927.

EddieGP mentioned this in T166290: Provide a version of frwiki on Beta Cluster / staging.Apr 13 2018, 11:10 PM

fr.wikipedia.beta.wmflabs.org uses an invalid security certificateClosed, ResolvedPublicActions

Description

Details

Related Objects

Event Timeline

fr.wikipedia.beta.wmflabs.org uses an invalid security certificate
Closed, ResolvedPublic
Actions