Re: HTTPS support for geo DNS mirrors

On Wed, Aug 5, 2015 at 7:48 PM, Michael Fincham
<[email protected]> wrote:
>
> I've just had a member of the public approach me regarding a certificate error on www.php.net. As it stands the only valid name on the certificate we serve up is the canonical name of our mirror service: mirrors.catalyst.net.nz, and this has caused a warning dialog to show in their browser.
>
> Given that a Google search for "php" produces an https://www.php.net/ link as the top result, has any consideration been given to making the TLS situation better with geo DNS? A survey of some of the other mirror sites seems to suggest nobody has a cert for which 'www.php.net.nz' is valid, and some don't support HTTPS at all.

    Presuming the www.php.net.nz reference above is a typo, I'll
address the php.net and www.php.net configuration.

    At present, because of the default nature of SSL/HTTPS requiring
the sharing of a certificate and key, no, we don't support php.net or
www.php.net over HTTPS.  There has been internal discussion regarding
this, however, including the possibility of using a keyless SSL
configuration, but there presently no plan or a timeline to
implementation.

-- 
</Daniel P. Brown>
Network Infrastructure Manager
http://www.php.net/