Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99957
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain lerdorf.com designates 209.85.218.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CANUQDCjB9UY8jTmmp43bQAW_9xJnoMbREN1zOQh1LubTfO4C-w@mail.gmail.com>
References: <CA+aNembkpeU+vTX0dr1r_NuPZkKu4Da2rMTbS3RWk2eSacF_KA@mail.gmail.com>
 <CAESVnVrCndhLSuxZzNp5xqQLp8SC0wGSDAq8cjH+fRew-cCf1g@mail.gmail.com> <CANUQDCjB9UY8jTmmp43bQAW_9xJnoMbREN1zOQh1LubTfO4C-w@mail.gmail.com>
Date: Wed, 19 Jul 2017 20:40:49 -0400
Message-ID: <CACXBjuiL_=-qy53BWbB31_t_XJXqBguwVToS9bV=2K2np+zaRA@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: Sara Golemon <pollita@php.net>, Mathias Grimm <mathiasgrimm@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a1134f3446d8ed60554b50214"
Subject: Re: [PHP-DEV] php.net website
From: rasmus@lerdorf.com (Rasmus Lerdorf)

--001a1134f3446d8ed60554b50214
Content-Type: text/plain; charset="UTF-8"

On Wed, Jul 19, 2017 at 1:42 PM, Niklas Keller <me@kelunik.com> wrote:

>
> We should really change that and fully move to HTTPS.
>

I have looked at various ways of doing this, but it isn't trivial and it
has absolutely nothing to do with the actual html and slapping in some
https links instead of http. The problem here is that we have external
volunteers running all our mirrors and we do geo-dns for www.php.net to
your geographically close mirror site. Putting the private key for
www.php.net on dozens of servers around the world we don't control is a
non-starter.

One way that I played with was to use letsencrypt and have each mirror
request an ssl cert for their local mirror, ca1.php.net, for example, and
include a CN alias for www.php.net in that request. Then we would run
domain a validation gateway/proxy on www.php.net which would validate these
requests on behalf of the mirrors. But there are some security issues with
this approach that I haven't quite thought through. I would love to hear
suggestions for perhaps a simpler solution to this problem that doesn't
require pasting our private key all over the internet.

-Rasmus

--001a1134f3446d8ed60554b50214--