Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Mailing lists / fpc-devel / 2017-05

Let's Encrypt cert and mantis.freepascal.org

14 messages · 9 people · –

Reply by email Subscribe to this list Your subscription

Read-only archive. Use j and k to move between messages.

Dimitrios Chr. Ioannidis

Hi,

is it possible to add the domain mantis.freepascal.org in the let's encrypt cert or change the subversion bugtrack:url property from mantis.freepascal.org to bugs.freepascal.org ?

I use a lot the svn log and when I'm clicking the bug id I get a SSL_ERROR_BAD_CERT_DOMAIN which is a little bit annoying .

regards,

Dimitrios Chr. Ioannidis

Reply by email

Michael Van Canneyt
to Dimitrios Chr. Ioannidis
Dimitrios Chr. Ioannidis wrote 5 lines
Hi, is it possible to add the domain mantis.freepascal.org in the let's encrypt cert or change the subversion bugtrack:url property from mantis.freepascal.org to bugs.freepascal.org ?

Changed the bugtraq:url. Revision 36062.

Michael.

Reply by email

Tomas Hajny
to Michael Van Canneyt
Michael Van Canneyt wrote
On Tue, 2 May 2017, Dimitrios Chr. Ioannidis via fpc-devel wrote:

Hi Michael,

Show quoted text 5 lines
> is it possible to add the domain mantis.freepascal.org in the let's > encrypt cert or change the subversion bugtrack:url property from > mantis.freepascal.org to bugs.freepascal.org ? Changed the bugtraq:url. Revision 36062.

That's probably good as the fastest / short-term solution, but as long as both DNS records are valid and point to the same IP address (and http access to both is redirected to the https version), the certificate should cover both domain names as well.

Tomas

Reply by email

Michael Van Canneyt
to Tomas Hajny
Tomas Hajny wrote 16 lines
On Tue, May 2, 2017 19:20, Michael Van Canneyt wrote: > On Tue, 2 May 2017, Dimitrios Chr. Ioannidis via fpc-devel wrote: Hi Michael, >> is it possible to add the domain mantis.freepascal.org in the let's >> encrypt cert or change the subversion bugtrack:url property from >> mantis.freepascal.org to bugs.freepascal.org ? > > Changed the bugtraq:url. Revision 36062. That's probably good as the fastest / short-term solution, but as long as both DNS records are valid and point to the same IP address (and http access to both is redirected to the https version), the certificate should cover both domain names as well.

That mayb be so, but I have no idea how to do this. As far as I know, lets encrypt does not support wildcard certificates.

Michael.

Reply by email

Martin
to Michael Van Canneyt
Michael Van Canneyt wrote 10 lines
> That's probably good as the fastest / short-term solution, but as > long as > both DNS records are valid and point to the same IP address (and http > access to both is redirected to the https version), the certificate > should > cover both domain names as well. That mayb be so, but I have no idea how to do this. As far as I know, lets encrypt does not support wildcard certificates.

I would think you need 2 individual certs.

Since both domains are on the same IP, the server must support SNI (but most servers do).

Then have 2 virtual hosts, one for each domain. Each using the correct cert for its domain.
The rest of the virtualhosts will be a copy of each other (or including the same include file)

Reply by email

Michael Van Canneyt
to Martin
Martin wrote 21 lines
On 02/05/2017 22:59, Michael Van Canneyt wrote: > >> That's probably good as the fastest / short-term solution, but as >> long as >> both DNS records are valid and point to the same IP address (and http >> access to both is redirected to the https version), the certificate >> should >> cover both domain names as well. > > That mayb be so, but I have no idea how to do this. > As far as I know, lets encrypt does not support wildcard certificates. I would think you need 2 individual certs. Since both domains are on the same IP, the server must support SNI (but most servers do). Then have 2 virtual hosts, one for each domain. Each using the correct cert for its domain. The rest of the virtualhosts will be a copy of each other (or including the same include file)

I will see if this is a possibility.

Michael.

Reply by email

Luca Olivetti
to Michael Van Canneyt: That mayb be so, but I have no idea how to do this. As far as I know, lets encrypt does…

El 02/05/17 a les 23:59, Michael Van Canneyt ha escrit:

Show quoted text 24 lines
On Tue, 2 May 2017, Tomas Hajny wrote: > On Tue, May 2, 2017 19:20, Michael Van Canneyt wrote: >> On Tue, 2 May 2017, Dimitrios Chr. Ioannidis via fpc-devel wrote: > > > Hi Michael, > >>> is it possible to add the domain mantis.freepascal.org in the let's >>> encrypt cert or change the subversion bugtrack:url property from >>> mantis.freepascal.org to bugs.freepascal.org ? >> >> Changed the bugtraq:url. Revision 36062. > > That's probably good as the fastest / short-term solution, but as long as > both DNS records are valid and point to the same IP address (and http > access to both is redirected to the https version), the certificate > should > cover both domain names as well. That mayb be so, but I have no idea how to do this. As far as I know, lets encrypt does not support wildcard certificates.

But it supports more than one name in the same certificate. I'm using dehydrated[1] and it's just a matter of specifying all the domains in the same line in domains.txt.
Other acme clients should support it as well.

[1]https://github.com/lukas2511/dehydrated

Bye

Luca

Reply by email

Tomas Hajny
to Michael Van Canneyt: I will see if this is a possibility. Michael.
Michael Van Canneyt wrote 24 lines
On Tue, 2 May 2017, Martin wrote: > On 02/05/2017 22:59, Michael Van Canneyt wrote: >> >>> That's probably good as the fastest / short-term solution, but as >>> long as >>> both DNS records are valid and point to the same IP address (and http >>> access to both is redirected to the https version), the certificate >>> should >>> cover both domain names as well. >> >> That mayb be so, but I have no idea how to do this. >> As far as I know, lets encrypt does not support wildcard certificates. > > I would think you need 2 individual certs. > > Since both domains are on the same IP, the server must support SNI (but > most servers do). > > Then have 2 virtual hosts, one for each domain. Each using the correct > cert for its domain. > The rest of the virtualhosts will be a copy of each other (or including > the same include file) I will see if this is a possibility.

As far as I can see, having a certificate for multiple domain names seems perfectly possible with Let's Encrypt - see
https://www.digitalocean.com/community/tutorials/how-to-set-up-let-s-encrypt-certificates-for-multiple-apache-virtual-hosts-on-ubuntu-16-04, or
https://community.letsencrypt.org/t/host-multiple-domains-with-a-single-certificate/20917/2
- there's no need for wildcards, just for the complete list of valid domain names you want to cover.

BTW, the certificate used for www.freepascal.org should include plain freepascal.org, because an access to http://freepascal.org results in a security complaint from the browser now.

Tomas

Reply by email

silvioprog
to Michael Van Canneyt: That mayb be so, but I have no idea how to do this. As far as I know, lets encrypt does…
Michael Van Canneyt wrote 10 lines
On Tue, 2 May 2017, Tomas Hajny wrote: > On Tue, May 2, 2017 19:20, Michael Van Canneyt wrote: > >> On Tue, 2 May 2017, Dimitrios Chr. Ioannidis via fpc-devel wrote: >> > > Hi Michael, >

Hello dudes,

Show quoted text 16 lines
is it possible to add the domain mantis.freepascal.org in the let's >>> encrypt cert or change the subversion bugtrack:url property from >>> mantis.freepascal.org to bugs.freepascal.org ? >>> >> >> Changed the bugtraq:url. Revision 36062. >> > > That's probably good as the fastest / short-term solution, but as long as > both DNS records are valid and point to the same IP address (and http > access to both is redirected to the https version), the certificate should > cover both domain names as well. > That mayb be so, but I have no idea how to do this.

Which client was used in the challenge, certbot? It allows to specify many domains (however, I'm using acme-client today, but some time ago I used certbot and got success with sub-domains too, eg: www.mydomain.com, smtp.mydomain.com, docs.mydomain.com etc.).

As far as I know, lets encrypt does not support wildcard certificates.

Michael.

I have some knowledge about this issue and I would be glad to help on that.

I've replaced certbot with acme-client because it have just some KBs against many MB of certbot and its dependencies. Acme-client was written in C, and its dependencies are just libbsd and libressl.

I did some changes in my copy to make it working in my Ubuntu Server 16.04, and I created a cron job that checks twice a day (time recommended by certbot/acme-client team) if the certificate is still valid.

Silvio Clécio

Reply by email

Michael Van Canneyt
to Tomas Hajny: As far as I can see, having a certificate for multiple domain names seems perfectly…
Tomas Hajny wrote 34 lines
On Wed, May 3, 2017 00:33, Michael Van Canneyt wrote: > On Tue, 2 May 2017, Martin wrote: >> On 02/05/2017 22:59, Michael Van Canneyt wrote: >>> >>>> That's probably good as the fastest / short-term solution, but as >>>> long as >>>> both DNS records are valid and point to the same IP address (and http >>>> access to both is redirected to the https version), the certificate >>>> should >>>> cover both domain names as well. >>> >>> That mayb be so, but I have no idea how to do this. >>> As far as I know, lets encrypt does not support wildcard certificates. >> >> I would think you need 2 individual certs. >> >> Since both domains are on the same IP, the server must support SNI (but >> most servers do). >> >> Then have 2 virtual hosts, one for each domain. Each using the correct >> cert for its domain. >> The rest of the virtualhosts will be a copy of each other (or including >> the same include file) > > I will see if this is a possibility. As far as I can see, having a certificate for multiple domain names seems perfectly possible with Let's Encrypt - see https://www.digitalocean.com/community/tutorials/how-to-set-up-let-s-encrypt-certificates-for-multiple-apache-virtual-hosts-on-ubuntu-16-04, or https://community.letsencrypt.org/t/host-multiple-domains-with-a-single-certificate/20917/2 - there's no need for wildcards, just for the complete list of valid domain names you want to cover.

I'll try this for mantis/bugs first.

Michael.

Reply by email

Michael Van Canneyt
to Ondrej Pokorny
Ondrej Pokorny wrote 10 lines
On 02.05.2017 19:20, Michael Van Canneyt wrote: > Changed the bugtraq:url. Revision 36062. Off-topic: I now switched from mantis.freepascal.org to bugs.freepascal.org and had to block the running cheetah icon again. Remember the good webpage designer (generally speaking UI designer) rule: Don't play endless animations. Never.

Considering that we're probably living in a simulation, we can stop living right now ?

Michael.

Reply by email

David Copeland
to Martin: I would think you need 2 individual certs. Since both domains are on the same IP, the…

Another alternative I have used is to get a new certificate that includes all the subdomains.

Dave Copeland.

Martin wrote 24 lines
On 02/05/2017 22:59, Michael Van Canneyt wrote: > >> That's probably good as the fastest / short-term solution, but as >> long as >> both DNS records are valid and point to the same IP address (and http >> access to both is redirected to the https version), the certificate >> should >> cover both domain names as well. > > That mayb be so, but I have no idea how to do this. > As far as I know, lets encrypt does not support wildcard certificates. I would think you need 2 individual certs. Since both domains are on the same IP, the server must support SNI (but most servers do). Then have 2 virtual hosts, one for each domain. Each using the correct cert for its domain. The rest of the virtualhosts will be a copy of each other (or including the same include file) _______________________________________________ fpc-devel maillist - http://lists.freepascal.org/cgi-bin/mailman/listinfo/fpc-devel
David Copeland JSI Data Systems Limited 613-727-9353 www.jsidata.ca

Reply by email

Sven Barth
to Michael Van Canneyt: I'll try this for mantis/bugs first. Michael.
Michael Van Canneyt wrote 42 lines
On Wed, 3 May 2017, Tomas Hajny wrote: > On Wed, May 3, 2017 00:33, Michael Van Canneyt wrote: >> On Tue, 2 May 2017, Martin wrote: >>> On 02/05/2017 22:59, Michael Van Canneyt wrote: >>>> >>>>> That's probably good as the fastest / short-term solution, but as >>>>> long as >>>>> both DNS records are valid and point to the same IP address (and http >>>>> access to both is redirected to the https version), the certificate >>>>> should >>>>> cover both domain names as well. >>>> >>>> That mayb be so, but I have no idea how to do this. >>>> As far as I know, lets encrypt does not support wildcard certificates. >>> >>> I would think you need 2 individual certs. >>> >>> Since both domains are on the same IP, the server must support SNI (but >>> most servers do). >>> >>> Then have 2 virtual hosts, one for each domain. Each using the correct >>> cert for its domain. >>> The rest of the virtualhosts will be a copy of each other (or including >>> the same include file) >> >> I will see if this is a possibility. > > As far as I can see, having a certificate for multiple domain names seems > perfectly possible with Let's Encrypt - see > https://www.digitalocean.com/community/tutorials/how-to-set-up-let-s-encrypt-certificates-for-multiple-apache-virtual-hosts-on-ubuntu-16-04, > > or > https://community.letsencrypt.org/t/host-multiple-domains-with-a-single-certificate/20917/2 > > - there's no need for wildcards, just for the complete list of valid > domain names you want to cover. I'll try this for mantis/bugs first.

Maybe you'll also want to do this for svn.freepascal.org (and svn2.freepascal.org?) as at least my PowerBook complained about the mismatched URL (aside from the root certificate not being trusted :P )

Regards,
Sven

Reply by email