Re: HTTPS support for geo DNS mirrors

On Thu, 6 Aug 2015 08:57:27 -0400, Daniel Brown <danbrown@php.net> wrote: > On Wed, Aug 5, 2015 at 7:48 PM, Michael Fincham > <michael.fincham@catalyst.net.nz> wrote: > > > > I've just had a member of the public approach me regarding a certificate error on > > www.php.net. As it stands the only valid name on the certificate we serve up is the canonical name > > of our mirror service: mirrors.catalyst.net.nz, and this has caused a warning dialog to show in > > their browser. > > > > Given that a Google search for "php" produces an > > https://www.php.net/ link as the top result, has any consideration > > been given to making the TLS situation better with geo DNS? A survey of some of the other mirror > > sites seems to suggest nobody has a cert for which 'www.php.net.nz' is valid, and some > > don't support HTTPS at all. > > Presuming the www.php.net.nz reference above is a typo, I'll > address the php.net and www.php.net configuration. > > At present, because of the default nature of SSL/HTTPS requiring > the sharing of a certificate and key, no, we don't support php.net or > www.php.net over HTTPS. There has been internal discussion regarding > this, however, including the possibility of using a keyless SSL > configuration, but there presently no plan or a timeline to > implementation. > > -- > </Daniel P. Brown> > Network Infrastructure Manager > http://www.php.net/ -- Michael Fincham, Senior Systems and Network Administrator Catalyst Phone: 04 499 2267 DDI: 04 803 2392

Attachment: [application/pgp-signature]