Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99960
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.219 cause and error)
MIME-Version: 1.0
In-Reply-To: <CACXBjuiL_=-qy53BWbB31_t_XJXqBguwVToS9bV=2K2np+zaRA@mail.gmail.com>
References: <CA+aNembkpeU+vTX0dr1r_NuPZkKu4Da2rMTbS3RWk2eSacF_KA@mail.gmail.com>
 <CAESVnVrCndhLSuxZzNp5xqQLp8SC0wGSDAq8cjH+fRew-cCf1g@mail.gmail.com>
 <CANUQDCjB9UY8jTmmp43bQAW_9xJnoMbREN1zOQh1LubTfO4C-w@mail.gmail.com> <CACXBjuiL_=-qy53BWbB31_t_XJXqBguwVToS9bV=2K2np+zaRA@mail.gmail.com>
Date: Thu, 20 Jul 2017 07:42:04 +0200
Message-ID: <CANUQDCjPwMUXjkn2LB7oZsY8ifwBAFjdaQpR6kzt9usSMnQjXw@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: Sara Golemon <pollita@php.net>, Mathias Grimm <mathiasgrimm@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a1140841c6b4d940554b9354d"
Subject: Re: [PHP-DEV] php.net website
From: me@kelunik.com (Niklas Keller)

--001a1140841c6b4d940554b9354d
Content-Type: text/plain; charset="UTF-8"

>
> I have looked at various ways of doing this, but it isn't trivial and it
> has absolutely nothing to do with the actual html and slapping in some
> https links instead of http. The problem here is that we have external
> volunteers running all our mirrors and we do geo-dns for www.php.net to
> your geographically close mirror site. Putting the private key for
> www.php.net on dozens of servers around the world we don't control is a
> non-starter.
>

I expected something like that. How does it work then that
https://www.php.net and https://php.net can redirect to
https://secure.php.net? I must be reaching a server with a valid
certificate, otherwise that wouldn't work.

If putting a private key for php.net doesn't work, then we should get rid
of these mirrors ASAP IMO.


> One way that I played with was to use letsencrypt and have each mirror
> request an ssl cert for their local mirror, ca1.php.net, for example, and
> include a CN alias for www.php.net in that request. Then we would run
> domain a validation gateway/proxy on www.php.net which would validate
> these
> requests on behalf of the mirrors. But there are some security issues with
> this approach that I haven't quite thought through. I would love to hear
> suggestions for perhaps a simpler solution to this problem that doesn't
> require pasting our private key all over the internet.
>

They can also just request them themselves, but only for their mirror
domain. If you allow them to issue for www.php.net, you can as well just
put the current private key there.

Regards, Niklas

--001a1140841c6b4d940554b9354d--