Re: HTTPS support for geo DNS mirrors

On 08/19/2015 02:23 PM, Michael Fincham wrote:
> On Wed, 19 Aug 2015 07:47:46 -0700, Hannes Magnusson <[email protected]> wrote:
>> mirror should have https disabled
> 
> Fair enough. This may take us a little while to implement - our mirror system hosts a few other sites and I suspect we'll need to add a dedicated IP for the PHP virtual host.

This is a bit annoying for ISPs. It would be nice if there was something
in SNI to help here, but I don't think there is.

We obviously can't distribute the private key for out wildcard *.php.net
cert out to every mirror, but maybe we should consider writing something
that could generate per-mirror certs for mirrors to get around this
problem and have the config either redirect to non-https or to
https://secure.php.net

-Rasmus

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlXVHGQACgkQlxayKTuqOuB4QgCfYsCICBt2lH52E7zAXg/9a8Ld
Vk8An02Q09AaVPg4GXnroUNNDITS+mHC
=64sU
-----END PGP SIGNATURE-----