Re: HTTPS support for geo DNS mirrors

Am 20.08.2015 02:17 schrieb "Rasmus Lerdorf" <[email protected]>:
>
> We obviously can't distribute the private key for out wildcard *.php.net
> cert out to every mirror, but maybe we should consider writing something
> that could generate per-mirror certs for mirrors to get around this
> problem

I don't think per-mirror certs, _if_ the geodns thing for www.php.net could
be made the only way to access the mirrors - i.e. the cc1.php.net names
could be ignored.

The whole thing would need an automated way to push new keys to the mirrors
anyway. What would then be more important, wrt mirrors being faded,
misbehaving, or having their key stolen, would be to have certificates with
rather short expiry, like a week or a month.

With the usual long certificate expiry, and certificate revocation not
really working (right?), a rogue mirror or victim of a breakin would
compromise the whole setup for a long time.

> and have the config either redirect to non-https or to
> https://secure.php.net

Hmm. If a good solution to the key distribution were in place, what would
stop us from running the normal site access through https, only redirecting
critical stuff that needs to be on central sites?

best regards
  Patrick