Last modified: 2013-01-14 12:43:56 UTC
Visiting https://integration.mediawiki.org/ direct or with a link from gerrit gives a bad certificate warning, because the certificate is for *.wikimedia.org. It is possible to get the right certificate here? Thanks. See also bug 40697
It's giving me a *.mediawiki.org certificate...
Cert is indeed *.mediawiki.org, assuming it got fixed somehow.
alex@alex:~/Git/Wikimedia/Operations/puppet (production)$ git blame files/apache/sites/integration.mediawiki.org | grep SSL 21b50367 (Antoine Musso 2011-11-17 14:50:15 +0100 112) SSLEngine on 3e2f00d4 (Antoine Musso 2011-12-21 19:42:25 +0100 113) SSLCertificateFile /etc/ssl/certs/star.mediawiki.org.pem 3e2f00d4 (Antoine Musso 2011-12-21 19:42:25 +0100 114) SSLCertificateKeyFile /etc/ssl/private/star.mediawiki.org.key 0e0d2d43 (dzahn 2011-12-28 16:52:37 +0100 115) SSLCACertificateFile /etc/ssl/certs/RapidSSL_CA.pem
With FireFox 17 I see a certificate for *.mediawiki.org from RapidSSL CA (GeoTrust, Inc.) from 18.07.2011 to 19.07.2016, all Okay. But with Internet Explorer 8 I see a certificate for *.wikimedia.org from Equifax (Equifax Secure Certificate Authority) from 03.08.2011 to 22.08.2015, not Okay I have cleared my cache, but there is something wrong with IE. Can someone test this with Internet Explorer? Thanks.
The server uses a certification per domain (mediawiki.org or wikimedia.org. The entries 'integration' points to the same IP address on which Apache is listening. To find out which hostname is actually requested, the web client and server uses the Server Name Indication system http://en.wikipedia.org/wiki/Server_Name_Indication . The system is not implemented for Internet Explorer under Windows XP: http://blogs.msdn.com/b/ieinternals/archive/2009/12/07/certificate-name-mismatch-warnings-and-server-name-indication.aspx So either: - get a more recent OS - use a different web browser - accept the certificate (I guess that would work) The only possible fix would be to have two different public IP address on the continuous integration host, one address per domain. We are never going to do that.
