Mailing lists / fpc-pascal / 2022-01
freepascal.org SSL_ERROR_BAD_CERT_DOMAIN
16 messages · 10 people · –
- Dmitry Boyarintsev 3
- Unknown author 3
- Marc Weustink 2
- Rainer Stratmann 2
- Dimitrios Chr. Ioannidis 1
- DougC 1
- +4 more
Reply by email Subscribe to this list Your subscription
Read-only archive. Use j and k to move between messages.
You probably want to give a bit more context here.
1. The error seems to be visible only in Safari (iOS or macOS). I did test Chrome, it fails to open "https://freepascal.org" and automagically reopens "www.freepascal.org". Thus the certificate error is not observed.
Chrome also suggested that request to "https://freepascal.org" fai (The similar behavior is seen on Edge, which is Chrome anyway)
2. I'd think it would be proper for the server of "freepascal.org" to response with a redirect to "www.freeepascal.org"
3. Even "www.freepascal.org" has a problem. The browser doesn't seem to like that the "search" form action is leading to insecure " http://forum.lazarus.freepascal.org/index.php?action=search" and thus a warning sign is shown
[image: image.png]
thanks,
Dmitry
On Tue, Jan 4, 2022 at 7:00 PM Rainer Stratmann via fpc-pascal <
Show quoted text 9 lines
wrote:
https://freepascal.org/
_______________________________________________
fpc-pascal maillist -
https://lists.freepascal.org/cgi-bin/mailman/listinfo/fpc-pascal
Dmitry Boyarintsev via fpc-pascal wrote on 5/1/22 12:17 pm:
You probably want to give a bit more context here. 1. The error seems to be visible only in Safari (iOS or macOS).
You can add the SeaMonkey web browser on FreeBSD to the list.
You can add Firefox on Windows 10 which also sees this error.
Seems not to be a browser issue. If the user requests an https: connection, the website should NOT revert to a http: connection. Instead it should return an error if the https: connection cannot be made.
---- On Tue, 04 Jan 2022 21:37:09 -0500 Trev via fpc-pascal wrote ----
Dmitry Boyarintsev via fpc-pascal wrote on 5/1/22 12:17 pm:
You probably want to give a bit more context here. 1. The error seems to be visible only in Safari (iOS or macOS).
You can add the SeaMonkey web browser on FreeBSD to the list.
https://freepascal.org/
Hi,
Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε:
the certificate issued for www.freepascal.org and not for freepascal.org .
It seems that the let's encrypt script was run with -d freepascal.org instead of -d *.freepascal.org .
See https://www.hardenize.com/report/freepascal.org/1641368056 .
regards,
Dimitrios Chr. Ioannidis
This was already reported on GitLab:
https://gitlab.com/freepascal.org/fpc/source/-/issues/39488
Dimitrios Chr. Ioannidis via fpc-pascal
schrieb am Mi., 5. Jan. 2022, 08:49:
Show quoted text 22 lines
Hi,
Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε:
> https://freepascal.org/
the certificate issued for www.freepascal.org and not for freepascal.org .
It seems that the let's encrypt script was run with -d freepascal.org
instead of -d *.freepascal.org .
See https://www.hardenize.com/report/freepascal.org/1641368056 .
regards,
--
Dimitrios Chr. Ioannidis
_______________________________________________
fpc-pascal maillist -
https://lists.freepascal.org/cgi-bin/mailman/listinfo/fpc-pascal
Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε: the…
On Wed, Jan 5, 2022 at 2:49 AM Dimitrios Chr. Ioannidis via fpc-pascal <
Show quoted text 7 lines
wrote:
the certificate issued for www.freepascal.org and not for freepascal.org .
It seems that the let's encrypt script was run with -d freepascal.org
instead of -d *.freepascal.org .
I don't know how it works for Open Source world, but for the commercial world wild-card certificates (*.freepascal.org) are more expensive, than a single name certificate (www.freepascal.org)
thanks,
Dmitry
Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε: the…
On Wed, 5 Jan 2022 09:40:49 +0200
"Dimitrios Chr. Ioannidis via fpc-pascal"
Show quoted text 10 lines
Hi,
Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε:
> https://freepascal.org/
the certificate issued for www.freepascal.org and not for
freepascal.org .
It seems that the let's encrypt script was run with -d freepascal.org
instead of -d *.freepascal.org .
or
-d freepascal.org,www.freepascal.org
Mattias
Hi,
Mattias Gaertner wrote 18 lines
On Wed, 5 Jan 2022 09:40:49 +0200
"Dimitrios Chr. Ioannidis via fpc-pascal"
wrote:
> Hi,
>
> Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε:
> > https://freepascal.org/
>
> the certificate issued for www.freepascal.org and not for
> freepascal.org .
>
> It seems that the let's encrypt script was run with -d freepascal.org
> instead of -d *.freepascal.org .
or
-d freepascal.org,www.freepascal.org
you're right of cource :)
regards,
Dimitrios Chr. Ioannidis
On Wed, Jan 5, 2022 at 2:49 AM Dimitrios Chr. Ioannidis via fpc-pascal < I don't know how…
Hi,
Dmitry Boyarintsev wrote 14 lines
On Wed, Jan 5, 2022 at 2:49 AM Dimitrios Chr. Ioannidis via fpc-pascal
wrote:
> the certificate issued for www.freepascal.org [1] and not for
> freepascal.org [2] .
>
> It seems that the let's encrypt script was run with -d
> freepascal.org [2]
> instead of -d *.freepascal.org [2] .
I don't know how it works for Open Source world, but for the
commercial world wild-card certificates (*.freepascal.org [2]) are
more expensive, than a single name certificate (www.freepascal.org
[1])
AFAIK, let's encrypt support's wildcard certificates from 2018. I don't know if anything is changed.
See,
https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html .
regards,
Dimitrios Chr. Ioannidis
Dimitrios Chr. Ioannidis wrote 20 lines
Hi,
On 2022-01-05 11:09, Dmitry Boyarintsev via fpc-pascal wrote:
> On Wed, Jan 5, 2022 at 2:49 AM Dimitrios Chr. Ioannidis via fpc-pascal
> wrote:
>
>> the certificate issued for www.freepascal.org [1] and not for
>> freepascal.org [2] .
>>
>> It seems that the let's encrypt script was run with -d
>> freepascal.org [2]
>> instead of -d *.freepascal.org [2] .
>
> I don't know how it works for Open Source world, but for the
> commercial world wild-card certificates (*.freepascal.org [2]) are
> more expensive, than a single name certificate (www.freepascal.org
> [1])
AFAIK, let's encrypt support's wildcard certificates from 2018. I don't
know if anything is changed.
I have made some changes, hopefully all is fixed...
Michael.
Hi,
Michael Van Canneyt wroteOn Wed, 5 Jan 2022, Dimitrios Chr. Ioannidis via fpc-pascal wrote:
< snip >
> AFAIK, let's encrypt support's wildcard certificates from 2018. I > don't know if anything is changed. I have made some changes, hopefully all is fixed...
now it works, thank you Michael .
FYI,
https://www.hardenize.com/report/freepascal.org/1641377302#www_certs .
PS: Plz if it is possible resolve the
https://gitlab.com/freepascal.org/fpc/source/-/issues/39488 also.
regards,
Dimitrios Chr. Ioannidis
I have made some changes, hopefully all is fixed... Michael.
Here it is ok now.
Linux Debian, Firefox Browser
Am Mittwoch, 5. Januar 2022, 11:05:34 CET schrieb Michael Van Canneyt via fpc- pascal:
Show quoted text 28 lines
On Wed, 5 Jan 2022, Dimitrios Chr. Ioannidis via fpc-pascal wrote:
> Hi,
>
> On 2022-01-05 11:09, Dmitry Boyarintsev via fpc-pascal wrote:
>> On Wed, Jan 5, 2022 at 2:49 AM Dimitrios Chr. Ioannidis via fpc-pascal
>>
>> wrote:
>>> the certificate issued for www.freepascal.org [1] and not for
>>> freepascal.org [2] .
>>>
>>> It seems that the let's encrypt script was run with -d
>>> freepascal.org [2]
>>> instead of -d *.freepascal.org [2] .
>>
>> I don't know how it works for Open Source world, but for the
>> commercial world wild-card certificates (*.freepascal.org [2]) are
>> more expensive, than a single name certificate (www.freepascal.org
>> [1])
>
> AFAIK, let's encrypt support's wildcard certificates from 2018. I don't
> know if anything is changed.
I have made some changes, hopefully all is fixed...
Michael.
_______________________________________________
fpc-pascal maillist -
https://lists.freepascal.org/cgi-bin/mailman/listinfo/fpc-pascal
I have made some changes, hopefully all is fixed... Michael.
On Wed, Jan 5, 2022 at 5:05 AM Michael Van Canneyt via fpc-pascal <
wrote: I have made some changes, hopefully all is fixed..
The redirect has been added.
Can the search form also be changed to use "https://" instead of "http://" as its action?
Currently it is:
<form action="http://forum.lazarus.freepascal.org/index.php?action=search" method="get">
<p><input type="text" name="q" size="20" maxlength="256"></p> <p><input type="submit" value="Search" name="t">
<input type="submit" value="Feeling Lucky" name="t"> </p>
</form>
thanks,
Dmtry
On Wed, 5 Jan 2022 09:40:49 +0200 "Dimitrios Chr. Ioannidis via fpc-pascal" or -d…
Mattias Gaertner wrote 18 lines
On Wed, 5 Jan 2022 09:40:49 +0200
"Dimitrios Chr. Ioannidis via fpc-pascal"
wrote:
> Hi,
>
> Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε:
>> https://freepascal.org/
>
> the certificate issued for www.freepascal.org and not for
> freepascal.org .
>
> It seems that the let's encrypt script was run with -d freepascal.org
> instead of -d *.freepascal.org .
or
-d freepascal.org,www.freepascal.org
Better, since forum.lazarus.freepascal.org is not served by this server and has a different LE certificate.
if lets encrypt registers certificates right, there cannot exist a *.freepascal.org and a different forum.lazarus.freepascal.org cert.
Marc
Marc Weustink wrote 27 lines
On 5-1-2022 10:15, Mattias Gaertner via fpc-pascal wrote:
> On Wed, 5 Jan 2022 09:40:49 +0200
> "Dimitrios Chr. Ioannidis via fpc-pascal"
> wrote:
>
>> Hi,
>>
>> Στις 5/1/2022 2:00 π.μ., ο/η Rainer Stratmann via fpc-pascal έγραψε:
>>> https://freepascal.org/
>>
>> the certificate issued for www.freepascal.org and not for
>> freepascal.org .
>>
>> It seems that the let's encrypt script was run with -d freepascal.org
>> instead of -d *.freepascal.org .
>
> or
>
> -d freepascal.org,www.freepascal.org
Better, since forum.lazarus.freepascal.org is not served by this server
and has a different LE certificate.
if lets encrypt registers certificates right, there cannot exist a
*.freepascal.org and a different forum.lazarus.freepascal.org cert.
OK, after some reading, this seems to be allowed.
However while reading I noticed that *.freepascal.org doesn't cover freepascal.org. You have to define it separate
Marc