Re: HTTPS support for geo DNS mirrors

[email protected] (Michael Fincham) Fri, 7 Aug 2015 09:22:24 +1200

Newsgroups	php.mirrors
Message-ID	<[email protected]>

On Thu, 6 Aug 2015 08:57:27 -0400, Daniel Brown <[email protected]> wrote:
> On Wed, Aug 5, 2015 at 7:48 PM, Michael Fincham
> <[email protected]> wrote:
> >
> > I've just had a member of the public approach me regarding a certificate error on www.php.net. As it stands the only valid name on the certificate we serve up is the canonical name of our mirror service: mirrors.catalyst.net.nz, and this has caused a warning dialog to show in their browser.
> >
> > Given that a Google search for "php" produces an https://www.php.net/ link as the top result, has any consideration been given to making the TLS situation better with geo DNS? A survey of some of the other mirror sites seems to suggest nobody has a cert for which 'www.php.net.nz' is valid, and some don't support HTTPS at all.
> 
>     Presuming the www.php.net.nz reference above is a typo, I'll
> address the php.net and www.php.net configuration.
> 
>     At present, because of the default nature of SSL/HTTPS requiring
> the sharing of a certificate and key, no, we don't support php.net or
> www.php.net over HTTPS.  There has been internal discussion regarding
> this, however, including the possibility of using a keyless SSL
> configuration, but there presently no plan or a timeline to
> implementation.
> 
> -- 
> </Daniel P. Brown>
> Network Infrastructure Manager
> http://www.php.net/


-- 
Michael Fincham, Senior Systems and Network Administrator
Catalyst
Phone: 04 499 2267
DDI: 04 803 2392

signature.asc (application/pgp-signature, 819 B)