#2025: ssl warning for wiki.einsteintoolkit.org --------------------------------------+------------------------------------- Reporter: rhaas | Owner: Type: defect | Status: new Priority: major | Milestone: Component: EinsteinToolkit website | Version: development version Resolution: | Keywords: --------------------------------------+-------------------------------------
Comment (by hinder):
According to sslshopper, https://www.sslshopper.com/ssl- checker.html#hostname=wiki.einsteintoolkit.org, all the correct intermediate certificates are installed, and the certificate should be recognised by all major web browsers. The root CA is not LSU; it is "InCommon RSA Server CA".
However, the problem is that the leaf certificate does not have a common name which matches the URL being used; the CN is wiki.cct.lsu.edu. This is probably why Firefox and Chromium don't accept it. ... Yes, on my laptop, Firefox says
wiki.einsteintoolkit.org uses an invalid security certificate. The certificate is only valid for wiki.cct.lsu.edu Error code: SSL_ERROR_BAD_CERT_DOMAIN
when you click "Advanced".
We have always used the URL "docs.einsteintoolkit.org" for our wiki (I have no idea why).
For simplicity at this point, I would probably just remove wiki.einsteintoolkit.org from DNS. It is currently a CNAME alias for wiki.cct.lsu.edu, which is a completely different server (currently 130.39.21.6, vs 130.39.21.43 for docs.einsteintoolkit.org). This is completely wrong.
A better solution would be to start using wiki.einsteintoolkit.org as the official name of our wiki (it contains more than just documentation), generate a certificate with names wiki.einsteintoolkit.org and docs.einsteintoolkit.org, and have docs repoint to wiki.
But the first option is much more likely to get implemented on a short timescale...
PS: Roland, you could also add a bookmark, since you seem unable to remember the URL ;)