Re: HTTPS support for geo DNS mirrors

On Thu, Aug 6, 2015 at 2:27 PM, Michael Fincham
<[email protected]> wrote:
> Apologies for the last reply being empty :(
>
> On Thu, 6 Aug 2015 08:57:27 -0400, Daniel Brown <[email protected]> wrote:
>> At present, because of the default nature of SSL/HTTPS requiring
>> the sharing of a certificate and key, no, we don't support php.net or
>> www.php.net over HTTPS.
>
> Fair enough, it is certainly a non-trivial problem to solve.
>
> It is worth noting that Google seems to be directing people to the site over HTTPS though, see this screenshot from a local search for "PHP": <https://drive.google.com/file/d/0ByYSbmc9YE-cSm92OHA5b29WWUU/view?usp=sharing>
>
> Based on this I suspect folks are going to be running in to certificate errors (and we have indeed already had one person report a "weird certificate" to us). I am not sure what could be done to solve this, though.
>
> Would you prefer port 443 just not listen? We'd need to re-jig our mirror server if that was the case but it could be done.



I think so yes.
This isn't exactly my field of expertise, so figuring out a solution
for this problem will take a while.
The keyless idea went out the window once we realized Cloudflare had
only open sourced one component out of the whole thing.

Currently I'm waiting to see what comes out of https://letsencrypt.org/

In the meanwhile, https should be accessed through
https://secure.php.net and mirror should have https disabled

-Hannes