Re: SSL for PHP mirrors

Last time ("long" time ago) when I was thinking about this was if we (
master.php.net) would generate the www along with every mirror combination
(lv, lv2, and us, us2, us3, ...) through letsencrypt, and then have the
individual mirror maintainers retrieve their certificates, with a
pregenerated key through master.php.net/getcert.php?mirror=cc&key=...

e.g.

we'd generate a cert for
www us us1 -> accessible through
master.php.net/getcert.php?mirror=us1&key=abc
www lv lv2 -> accessible through
master.php.net/getcert.php?mirror=lv2&key=cba
...

The certs would be issued for short period of time, say a week, and the
mirrors would fetch their most-up2date cert after their rsync conrjobs, and
then gracefully restart their webservers to pick it up...

Just thinking outloud. Haven't tried this, nor will I have time for it over
xmas :(

-Hannes


On Mon, Dec 21, 2015 at 11:18 PM, Kaspars Foigts <[email protected]> wrote:

> Hi!
>
> I believe there could be few ways to work around this but that would boil
> down to provisioning one cert to all of mirrors, which is not very secure
> solution :)
>
>
>
> On Tue, Dec 22, 2015 at 5:47 AM, Rasmus Lerdorf <[email protected]>
> wrote:
>
>> On Dec 21, 2015, at 18:16, Hannes Magnusson <[email protected]>
>> wrote:
>> >
>> >> On Mon, Dec 14, 2015 at 1:09 PM, Kaspars Foigts <[email protected]>
>> wrote:
>> >> Hi!
>> >>
>> >> Since let's encrypt <https://letsencrypt.org/> has been launched into
>> >> public beta, in theory it is possible for each mirror's maintainer to
>> set
>> >> up a domain validated SSL virtualhost without involvement php.net
>> team (see
>> >> an example I set up at mine - https://lv.php.net/).
>> >
>> >
>> > Nice !
>> >
>> > I haven't had the time to look at this or really how letsencyrpt
>> > works. How did you verify lv.php.net? Would you be able to get the
>> > same cert for www?
>>
>> It would be cool if we could do per-mirror certs with letsencrypt and do
>> a SAN (subject alternate name) containing www.php.net. So it would be
>> lv.php.net and www.php.net on the same cert, for example. But I don't
>> know what we could set up to game their verification system to make this
>> work. It should be possible to set up something centrally that lets mirror
>> maintainers somehow proxy the verification.
>>
>> -Rasmus
>
>
>
>
> --
> Kaspars
> http://laacz.lv/
>
>
>