Setup internal wikis as https only
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	Platonides
	Feb 21 2011, 11:41 PM

Description

From wikitech-l thread:

Private wikis should require HTTPS by default.

Roughly this would need;

Setup a server for this role and give it an external ip.
Configure to answer https: with the star certificate and then perform the normal wiki routing.
Redirect http to https.
Change usage of bits load.php to the local one (avoid mixed content warnings and protect against active attackers).
Change the dns records to the new ip.
Profit!

No need for caching layer in front of it, as anonymous users can't read it. If there were, $wgCookieSecure may need to be manually set.

Version: unspecified
Severity: enhancement
URL: http://thread.gmane.org/gmane.science.linguistics.wikipedia.technical/52317

Details

Reference: bz27622

Related Objects
Search...

Status	Assigned	Task
Resolved	None	T29622 Setup internal wikis as https only
Resolved	None	T22643 Serve SSL/HTTPS sites out of same domain names as HTTP access: https://en.wikipedia.org/
Resolved	RyanLane	T18822 Provide SSL/HTTPS interface to upload.wikimedia.org and use it for SSL-served pages
Resolved	None	T33333 No SSL for MobileFrontend m. domain: https://en.m.wikipedia.org/ does not respond
Resolved	Reedy	T33335 Rename wikis with multiple subdomains
Resolved	None	T40763 Our *.wikimedia.org cert doesn't properly cover https://pa.us.wikimedia.org/
Resolved	None	T66977 https://wg.en.wikipedia.org is using an invalid certificate
Resolved	• Catrope	T31969 Protocol-relative URLs in ResourceLoader (CSSMin)

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:28 PM

• bzimport added projects: HTTPS, acl*sre-team.

• bzimport set Reference to bz27622.

• bzimport added a subscriber: Unknown Object (MLST).

Platonides created this task.Feb 21 2011, 11:41 PM

http://meta.wikimedia.org/wiki/Wikimedia_wikis#Private_wikis contains an organized list of internal/private wikis.

We're now testing office.wikimedia.org in http/https dual mode on the regular domain (per bug 20643); forcing it to SSL-only at this point should be pretty easy.

At this point rather than setting up a second HTTPS-only server to handle a couple domains, I'd recommend just continuing to build out that infrastructure for the other private/internal wikis and then flipping them to require SSL for logins; adding as a dependency.