<html>#2249: New TLS certificate for einsteintoolkit.org is self-signed and gives browser warnings/errors
<table style='border-spacing: 1ex 0pt; '>
<tr><td style='text-align:right'> Reporter:</td><td>Ian Hinder</td></tr>
<tr><td style='text-align:right'> Status:</td><td>new</td></tr>
<tr><td style='text-align:right'>Milestone:</td><td></td></tr>
<tr><td style='text-align:right'> Version:</td><td></td></tr>
<tr><td style='text-align:right'> Type:</td><td>bug</td></tr>
<tr><td style='text-align:right'> Priority:</td><td>critical</td></tr>
<tr><td style='text-align:right'>Component:</td><td>EinsteinToolkit website</td></tr>
</table>
<p>Comment (by Ian Hinder):</p>
<p>For reference, the following docker command will run a test on einsteintoolkit.org and catch the current problem. It takes 26 s to run, which is better than the 3 min taken by the full suite of tests.</p>
<div class="codehilite"><pre><span></span>mkdir logs
time sudo docker run -ti -v $PWD/logs:/tmp/logs drwetter/testssl.sh --server-defaults --color 0 --quiet --severity HIGH -oC /tmp/logs -oJ /tmp/logs -oL /tmp/logs -oH /tmp/logs einsteintoolkit.org
</pre></div>
<p>The standard output is human readable:</p>
<div class="codehilite"><pre><span></span> Start 2019-04-26 12:36:50 -->> 130.39.21.27:443 (einsteintoolkit.org) <<--
rDNS (130.39.21.27): einsteintoolkit.org.
Service detected: HTTP
Testing server defaults (Server Hello)
TLS extensions (standard) "server name/#0" "renegotiation info/#65281"
"EC point formats/#11" "session ticket/#35"
"heartbeat/#15"
"application layer protocol negotiation/#16"
Session Ticket RFC 5077 hint 300 seconds, session tickets keys seems to be rotated < daily
SSL Session ID support yes
Session Resumption Tickets: yes, ID: yes
TLS clock skew Random values, no fingerprinting possible
Signature Algorithm SHA256 with RSA
Server key size RSA 2048 bits
Server key usage --
Server extended key usage --
Serial / Fingerprints 91680BD8300459BB / SHA1 A06674AE0582BD65DFA9E5A43F28F32B59A29FF4
SHA256 80412717A02D2DE5FA41D6D26DE378397278F2983BE33AFEA9C6E6B75F1E8FCE
Common Name (CN) einsteintoolkit.org
subjectAltName (SAN) missing (NOT ok) -- Browsers are complaining
Issuer self-signed (NOT ok)
Trust (hostname) via CN only -- Browsers are complaining (same w/o SNI)
Chain of trust NOT ok (self signed)
EV cert (experimental)
<p>--<br/>
Ticket URL: <a href='https://bitbucket.org/einsteintoolkit/tickets/issues/2249/new-tls-certificate-for-einsteintoolkitorg'>https://bitbucket.org/einsteintoolkit/tickets/issues/2249/new-tls-certificate-for-einsteintoolkitorg</a></p>
</html>