Page MenuHomePhabricator

bad certificate on integration.mediawiki.org
Closed, DeclinedPublic

Description

Visiting https://integration.mediawiki.org/ direct or with a link from gerrit gives a bad certificate warning, because the certificate is for *.wikimedia.org.

It is possible to get the right certificate here? Thanks.

See also bug 40697


Version: wmf-deployment
Severity: normal

Details

Reference
bz43583

Event Timeline

bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 1:17 AM
bzimport set Reference to bz43583.
bzimport added a subscriber: Unknown Object (MLST).

It's giving me a *.mediawiki.org certificate...

Cert is indeed *.mediawiki.org, assuming it got fixed somehow.

alex@alex:~/Git/Wikimedia/Operations/puppet (production)$ git blame files/apache/sites/integration.mediawiki.org | grep SSL
21b50367 (Antoine Musso 2011-11-17 14:50:15 +0100 112) SSLEngine on
3e2f00d4 (Antoine Musso 2011-12-21 19:42:25 +0100 113) SSLCertificateFile /etc/ssl/certs/star.mediawiki.org.pem
3e2f00d4 (Antoine Musso 2011-12-21 19:42:25 +0100 114) SSLCertificateKeyFile /etc/ssl/private/star.mediawiki.org.key
0e0d2d43 (dzahn 2011-12-28 16:52:37 +0100 115) SSLCACertificateFile /etc/ssl/certs/RapidSSL_CA.pem

With FireFox 17 I see a certificate for *.mediawiki.org from RapidSSL CA (GeoTrust, Inc.) from 18.07.2011 to 19.07.2016, all Okay.

But with Internet Explorer 8 I see a certificate for *.wikimedia.org from Equifax (Equifax Secure Certificate Authority) from 03.08.2011 to 22.08.2015, not Okay

I have cleared my cache, but there is something wrong with IE. Can someone test this with Internet Explorer? Thanks.

The server uses a certification per domain (mediawiki.org or wikimedia.org. The entries 'integration' points to the same IP address on which Apache is listening.

To find out which hostname is actually requested, the web client and server uses the Server Name Indication system http://en.wikipedia.org/wiki/Server_Name_Indication .

The system is not implemented for Internet Explorer under Windows XP: http://blogs.msdn.com/b/ieinternals/archive/2009/12/07/certificate-name-mismatch-warnings-and-server-name-indication.aspx

So either:

  • get a more recent OS
  • use a different web browser
  • accept the certificate (I guess that would work)

The only possible fix would be to have two different public IP address on the continuous integration host, one address per domain. We are never going to do that.