Re: HTTPS support for geo DNS mirrors

On Thu, Aug 6, 2015 at 2:27 PM, Michael Fincham <michael.fincham@catalyst.net.nz> wrote: > Apologies for the last reply being empty :( > > On Thu, 6 Aug 2015 08:57:27 -0400, Daniel Brown <danbrown@php.net> wrote: >> At present, because of the default nature of SSL/HTTPS requiring >> the sharing of a certificate and key, no, we don't support php.net or >> www.php.net over HTTPS. > > Fair enough, it is certainly a non-trivial problem to solve. > > It is worth noting that Google seems to be directing people to the site over HTTPS though, see > this screenshot from a local search for "PHP": > <https://drive.google.com/file/d/0ByYSbmc9YE-cSm92OHA5b29WWUU/view?usp=sharing> > > Based on this I suspect folks are going to be running in to certificate errors (and we have > indeed already had one person report a "weird certificate" to us). I am not sure what > could be done to solve this, though. > > Would you prefer port 443 just not listen? We'd need to re-jig our mirror server if that > was the case but it could be done. I think so yes. This isn't exactly my field of expertise, so figuring out a solution for this problem will take a while. The keyless idea went out the window once we realized Cloudflare had only open sourced one component out of the whole thing. Currently I'm waiting to see what comes out of https://letsencrypt.org/ In the meanwhile, https should be accessed through https://secure.php.net and mirror should have https disabled -Hannes