Re: SSL for PHP mirrors

Hi guys,

I'm just wondering, did somebody with an email ending with @php.net tried to contact letsencrypt or other CA to explain the special situation we're in? Maybe they have a workaround for us...

Thank you,
Stefan.

> On Dec 22, 2015, at 07:24, Hannes Magnusson <[email protected]> wrote:
> 
> Last time ("long" time ago) when I was thinking about this was if we (
> master.php.net) would generate the www along with every mirror combination
> (lv, lv2, and us, us2, us3, ...) through letsencrypt, and then have the
> individual mirror maintainers retrieve their certificates, with a
> pregenerated key through master.php.net/getcert.php?mirror=cc&key=...
> 
> e.g.
> 
> we'd generate a cert for
> www us us1 -> accessible through
> master.php.net/getcert.php?mirror=us1&key=abc
> www lv lv2 -> accessible through
> master.php.net/getcert.php?mirror=lv2&key=cba
> ...
> 
> The certs would be issued for short period of time, say a week, and the
> mirrors would fetch their most-up2date cert after their rsync conrjobs, and
> then gracefully restart their webservers to pick it up...
> 
> Just thinking outloud. Haven't tried this, nor will I have time for it over
> xmas :(
> 
> -Hannes
> 
> 
>> On Mon, Dec 21, 2015 at 11:18 PM, Kaspars Foigts <[email protected]> wrote:
>> 
>> Hi!
>> 
>> I believe there could be few ways to work around this but that would boil
>> down to provisioning one cert to all of mirrors, which is not very secure
>> solution :)
>> 
>> 
>> 
>> On Tue, Dec 22, 2015 at 5:47 AM, Rasmus Lerdorf <[email protected]>
>> wrote:
>> 
>>> On Dec 21, 2015, at 18:16, Hannes Magnusson <[email protected]>
>>> wrote:
>>>> 
>>>>> On Mon, Dec 14, 2015 at 1:09 PM, Kaspars Foigts <[email protected]>
>>> wrote:
>>>>> Hi!
>>>>> 
>>>>> Since let's encrypt <https://letsencrypt.org/> has been launched into
>>>>> public beta, in theory it is possible for each mirror's maintainer to
>>> set
>>>>> up a domain validated SSL virtualhost without involvement php.net
>>> team (see
>>>>> an example I set up at mine - https://lv.php.net/).
>>>> 
>>>> 
>>>> Nice !
>>>> 
>>>> I haven't had the time to look at this or really how letsencyrpt
>>>> works. How did you verify lv.php.net? Would you be able to get the
>>>> same cert for www?
>>> 
>>> It would be cool if we could do per-mirror certs with letsencrypt and do
>>> a SAN (subject alternate name) containing www.php.net. So it would be
>>> lv.php.net and www.php.net on the same cert, for example. But I don't
>>> know what we could set up to game their verification system to make this
>>> work. It should be possible to set up something centrally that lets mirror
>>> maintainers somehow proxy the verification.
>>> 
>>> -Rasmus
>> 
>> 
>> 
>> 
>> --
>> Kaspars
>> http://laacz.lv/
>> 
>> 
>>