Page MenuHomePhabricator

bad certificate on
Closed, DeclinedPublic


Visiting direct or with a link from gerrit gives a bad certificate warning, because the certificate is for *

It is possible to get the right certificate here? Thanks.

See also bug 40697

Version: wmf-deployment
Severity: normal



Event Timeline

bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 1:17 AM
bzimport set Reference to bz43583.
bzimport added a subscriber: Unknown Object (MLST).

It's giving me a * certificate...

Cert is indeed *, assuming it got fixed somehow.

alex@alex:~/Git/Wikimedia/Operations/puppet (production)$ git blame files/apache/sites/ | grep SSL
21b50367 (Antoine Musso 2011-11-17 14:50:15 +0100 112) SSLEngine on
3e2f00d4 (Antoine Musso 2011-12-21 19:42:25 +0100 113) SSLCertificateFile /etc/ssl/certs/
3e2f00d4 (Antoine Musso 2011-12-21 19:42:25 +0100 114) SSLCertificateKeyFile /etc/ssl/private/
0e0d2d43 (dzahn 2011-12-28 16:52:37 +0100 115) SSLCACertificateFile /etc/ssl/certs/RapidSSL_CA.pem

With FireFox 17 I see a certificate for * from RapidSSL CA (GeoTrust, Inc.) from 18.07.2011 to 19.07.2016, all Okay.

But with Internet Explorer 8 I see a certificate for * from Equifax (Equifax Secure Certificate Authority) from 03.08.2011 to 22.08.2015, not Okay

I have cleared my cache, but there is something wrong with IE. Can someone test this with Internet Explorer? Thanks.

The server uses a certification per domain ( or The entries 'integration' points to the same IP address on which Apache is listening.

To find out which hostname is actually requested, the web client and server uses the Server Name Indication system .

The system is not implemented for Internet Explorer under Windows XP:

So either:

  • get a more recent OS
  • use a different web browser
  • accept the certificate (I guess that would work)

The only possible fix would be to have two different public IP address on the continuous integration host, one address per domain. We are never going to do that.