Accueil » Web » Tickets
Soumis par andrew le jeu, 03/21/2013 - 04:52

Trisquel SSL certificate needs renewal

Projet:Web
Composant:Main
Catégorie:Rapporter un bogue
Priorité:critical
Attribué:david
Statut:closed
Description

When visiting https://trisquel.info/ I got the error "This Connection is Untrusted". The certificate appeared to expired on 20/03/13 23:59 UTC, a few hours ago.

I've marked this as critical because:
- DuckDuckGo, the default Trisquel search engine, automatically links to the HTTPS site.
- HTTPS Everywhere is a popular Mozilla extension that automatically uses the HTTPS site.
- Many users appear to use it (I see https://trisquel.info links on forums and the tracker a lot)

TonyH:
jeu, 03/21/2013 - 08:56

Yes it would appear that the Pidgin instant messenger is reading the Jabber certificate as invalid too. I wonder if it expired and just needs to be replaced? Hope it's not too serious.

david:
jeu, 03/21/2013 - 12:30
Assigné à:anonymous» david
Statut:active» patch (needs work)

Hi!

The problem with the certificate is just that it expired; we forgot to realize that the provider of the previous certificate stopped their service in this regard last year, so the usual renovation warning emails were not sent.

In any case, we'll have to switch providers. I'm trying the service of other provider and have just set a new certificate for the web page and the jabber server. We'll probably be changing some settings for everything to work properly, so don't panic, but please by all means report any unexpected behaviour.

Thanks for your help!

lembas:
jeu, 03/21/2013 - 14:49

silly little cosmetic wrinkle, "trisquel.info run by (unknown)"

Pièce jointeTaille
Screenshot at 2013-03-21 14:45:23.png 7.16 Ko
andrew:
jeu, 03/21/2013 - 23:22

Thanks for taking care of that david. :-)

david:
ven, 03/22/2013 - 01:29

About the "run by unknown" stuff, it seems it cannot be changed with the certificate provider I've tried, at least not with a Class 1 certificate. I'll be looking at some other options in any case.

I changed the SSL setup of the Jabber server so the new certificate should be auto-accepted, by the way; feel free to update with any observed issue.

david:
ven, 03/22/2013 - 13:56
Statut:patch (needs work)» fixed

I hadn't actually configured the certificate chain properly, which led to issue https://trisquel.info/en/issues/7932

I've now reviewed all configuration and run some tests and I think it's pretty much ok. About the "Run by (Unknown)" stuff, I checked for a bit and even acquiring another type of certificate that allows for proper identification, it seems it would still show that string on Firefox. Check Google for verification. I mean, like https://google.com , I didn't mean for you to search in Google or... :D

Still please update this issue if you find any problem with the set-up.

lembas:
ven, 03/22/2013 - 15:32

>About the "Run by (Unknown)" stuff, I checked for a bit and even acquiring another type of certificate that allows for proper identification, it seems it would still show that string on Firefox. Check Google for verification. I mean, like https://google.com , I didn't mean for you to search in Google or... :D

Ah, you're right. I should've done that first. Weird.

quidam:
ven, 04/05/2013 - 15:35
Statut:fixed» closed

Automatically closed -- issue fixed for 2 weeks with no activity.