Skip to content
This repository has been archived by the owner on Jan 3, 2018. It is now read-only.

Invalid HTTPS certs for software-carpentry.org and files.software-carpentry.org #509

Closed
wking opened this issue May 22, 2014 · 12 comments
Closed
Assignees

Comments

@wking
Copy link
Contributor

wking commented May 22, 2014

We need working HTTPS for secure downloads of binary files (securing both the download itself and our published hashes for verifying the download, see swcarpentry/DEPRECATED-bc#488). However, neither site currently has a cert with the right common name or one signed by an “official” CA:

$ wget https://files.software-carpentry.org/SWCarpentryInstaller.exe
 --2014-05-20 09:10:38-- https://files.software-carpentry.org/SWCarpentryInstaller.exe
Resolving files.software-carpentry.org... 174.136.14.108
Connecting to files.software-carpentry.org|174.136.14.108|:443... connected.
ERROR: cannot verify files.software-carpentry.org's certificate, issued by ‘/C=US/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=vps1.sensibleadventures.com/[email protected]’:
  Self-signed certificate encountered.
    ERROR: certificate common name ‘vps1.sensibleadventures.com’ doesn't match requested host name ‘files.software-carpentry.org’.
To connect to files.software-carpentry.org insecurely, use `--no-check-certificate'.

$ wget https://software-carpentry.org/
--2014-05-20 09:18:09-- https://software-carpentry.org/
Resolving software-carpentry.org... 174.136.14.108
Connecting to software-carpentry.org|174.136.14.108|:443... connected.
ERROR: cannot verify software-carpentry.org's certificate, issued by ‘/C=US/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=vps1.sensibleadventures.com/[email protected]’:
  Self-signed certificate encountered.
    ERROR: certificate common name ‘vps1.sensibleadventures.com’ doesn't match requested host name ‘software-carpentry.org’.
To connect to software-carpentry.org insecurely, use `--no-check-certificate'.
@gvwilson
Copy link
Contributor

@pipitone any progress on this?

@pipitone
Copy link
Contributor

Fixed. Closing.

@wking
Copy link
Contributor Author

wking commented Jan 27, 2015

On Mon, Jan 26, 2015 at 06:05:56PM -0800, Jon Pipitone wrote:

Fixed. Closing.

It looks like you missed files.software-carpentry.org:

$ wget https://files.software-carpentry.org/SWCarpentryInstaller.exe
--2015-01-26 18:51:28-- https://files.software-carpentry.org/SWCarpentryInstaller.exe
ERROR: Failed to open cert /etc/ssl/certs/README.RootCerts: (0).
Resolving files.software-carpentry.org... 143.95.62.73
Connecting to files.software-carpentry.org|143.95.62.73|:443... connected.
GnuTLS: A TLS warning alert has been received.
GnuTLS: received alert [112]: The server name sent was not recognized
The certificate's owner does not match hostname ‘files.software-carpentry.org’

Hitting https://files.software-carpentry.org/ in Firefox gives me:

files.software-carpentry.org uses an invalid security certificate.

The certificate is only valid for the following names:
software-carpentry.org , www.software-carpentry.org

(Error code: ssl_error_bad_cert_domain)

@wking
Copy link
Contributor Author

wking commented Jan 27, 2015

On Mon, Jan 26, 2015 at 06:50:13PM -0800, W. Trevor King wrote:

The certificate is only valid for the following names:
software-carpentry.org , www.software-carpentry.org

It's probably best to get a single cert for software-carpentry.org and
*.software-carpentry.org. Then we don't have to get a new cert for
things like amy.software-carpentry.org.

@gvwilson
Copy link
Contributor

@pipitone can you please have a look at our other domains?

@pipitone
Copy link
Contributor

Bah.

On Jan 27, 2015, at 5:30 AM, Greg Wilson [email protected] wrote:

Assigned #509 to @pipitone.


Reply to this email directly or view it on GitHub.

@gvwilson
Copy link
Contributor

gvwilson commented Feb 5, 2015

@pipitone Can we now close this one?

@pipitone pipitone closed this as completed Feb 5, 2015
@wking
Copy link
Contributor Author

wking commented Feb 5, 2015

On Thu, Feb 05, 2015 at 11:03:52AM -0800, Jon Pipitone wrote:

Closed #509.

Yay! Thanks :).

wking added a commit to wking/workshop-template that referenced this issue Jan 11, 2016
These are the URLs suggested in the lesson docs since
swcarpentry/sql-novice-survey@ff0f411f (Making lesson conform to
template, 2015-02-12).  I'd prefer HTTPS links, but
files.software-carpentry.org still has an invalid certificate [1], and
[2,3] seem too different from the lesson docs.

[1]: swcarpentry/DEPRECATED-site#509
[2]: https://github.com/swcarpentry/files/raw/master/survey.db
[3]: https://github.com/swcarpentry/files/raw/master/survey.sql
@wking
Copy link
Contributor Author

wking commented Jan 11, 2016

On Mon, Jan 26, 2015 at 06:50:13PM -0800, W. Trevor King wrote:

Hitting https://files.software-carpentry.org/ in Firefox gives me:

files.software-carpentry.org uses an invalid security certificate.

The certificate is only valid for the following names:
software-carpentry.org , www.software-carpentry.org

(Error code: ssl_error_bad_cert_domain)

I'm still seeing this today. Did files.software-carpentry.org ever
get a valid certificate?

wking added a commit to wking/workshop-template that referenced this issue Jan 11, 2016
These are the URLs suggested in the lesson docs since
swcarpentry/sql-novice-survey@ff0f411f (Making lesson conform to
template, 2015-02-12).  I'd prefer HTTPS links, but
files.software-carpentry.org still has an invalid certificate [1], and
[2,3] seem too different from the lesson docs.

[1]: swcarpentry/DEPRECATED-site#509
[2]: https://github.com/swcarpentry/files/raw/master/survey.db
[3]: https://github.com/swcarpentry/files/raw/master/survey.sql
@gvwilson
Copy link
Contributor

gvwilson commented Jan 11, 2016 via email

@pbanaszkiewicz
Copy link
Member

@wking:

We have two certificates, one for software-carpentry.org and one for *.software-carpentry.org.

files.software-carpentry.org was moved to a different machine long time ago by me and I didn't set up the cert on it. I fixed it now, but I somehow managed to broke https://www.software-carpentry.org (it's being served as files.swc.org) - working on it.

@pbanaszkiewicz
Copy link
Member

The issue should now be fixed.

wking added a commit to wking/workshop-template that referenced this issue Mar 24, 2016
These are HTTPS versions of the URLs suggested in the lesson docs
since swcarpentry/sql-novice-survey@ff0f411f (Making lesson conform to
template, 2015-02-12).  I prefer HTTPS links for security, and while
files.software-carpentry.org has had an invalid certificate in the
past [1], it works now (2016-03-23).  As a fallback, you could use
[2,3], but they seem too different from the lesson docs for me to
prefer them here.

[1]: swcarpentry/DEPRECATED-site#509
[2]: https://github.com/swcarpentry/files/raw/master/survey.db
[3]: https://github.com/swcarpentry/files/raw/master/survey.sql
wking added a commit to wking/workshop-template that referenced this issue Mar 24, 2016
These are HTTPS versions of the URLs suggested in the lesson docs
since swcarpentry/sql-novice-survey@ff0f411f (Making lesson conform to
template, 2015-02-12).  I prefer HTTPS links for security, and while
files.software-carpentry.org has had an invalid certificate in the
past [1], it works now (2016-03-23).  As a fallback, you could use
[2,3], but they seem too different from the lesson docs for me to
prefer them here.

[1]: swcarpentry/DEPRECATED-site#509
[2]: https://github.com/swcarpentry/files/raw/master/survey.db
[3]: https://github.com/swcarpentry/files/raw/master/survey.sql
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants