Mailing-List: contact ooo-users-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: ooo-users@incubator.apache.org
MIME-Version: 1.0
In-Reply-To: <9528F28B-1594-463D-9EC9-419CEBBD3D93@comcast.net>
References: <507C01DB.3040509@rogers.com>
	<50806E1A.4030903@apache.org>
	<5080A5B5.2030000@rogers.com>
	<k6a4us$mpm$1@ger.gmane.org>
	<5088BE78.2000608@apache.org>
	<50892CD9.8010108@rogers.com>
	<508931AC.7070704@apache.org>
	<k6ca7m$50h$1@ger.gmane.org>
	<5092B54F.2@apache.org>
	<k6v4o9$3no$1@ger.gmane.org>
	<9528F28B-1594-463D-9EC9-419CEBBD3D93@comcast.net>
Date: Sun, 4 Nov 2012 17:00:18 -0500
Message-ID: 
 <CAP-ksohzcc++dttFZGWm0LhTho_5Au53dKEAOO_dFK-Y4Niy6w@mail.gmail.com>
Subject: Re: Bad site certificate
From: Rob Weir <robweir@apache.org>
To: ooo-users@incubator.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Sun, Nov 4, 2012 at 12:53 PM, Dave Fisher <dave2wave@comcast.net> wrote:
>
> On Nov 1, 2012, at 5:39 PM, NoOp wrote:
>
>> On 11/01/2012 10:45 AM, Andrea Pescetti wrote:
>>> On 25/10/2012 NoOp wrote:
>>>> On 10/25/2012 10:50 AM, Andrea Pescetti wrote:
>>>>> The recommended way to access the OpenOffice site in HTTPS for those =
who
>>>>> prefer it over HTTP is to use:
>>>>> https://ooo-site.apache.org
>>>> Like the above, the URL should be configured to automatically redirect
>>>> to https://ooo-site.apache.org when an https request is received?
>>>
>>> Apparently, this won't work since Infra says "Redirect won't work, as
>>> the SSL handshake precedes the first opportunity to send a redirect".
>>
>> That doesn't make any sense as I've already demonstrated that the other
>> https links to those IP addresses do indeed redirect.
>>
>>>
>>> But you are welcome to weigh in directly on
>>> https://issues.apache.org/jira/browse/INFRA-5450 :
>>> registration is open to everyone.
>>
>> Thanks, but no thanks. I suppose I could provide a server trace &
>> wireshark session file etc., but I doubt that it will do any good to
>> attempt to change Daniel Shahaf's mind.  You, however, might ask him
>> just how the other https links work on those IP's, yet the OOo link does
>> not, and why 443 is turned on for that URL to begin with if Apache do
>> not intend to support https on that link.
>
> If 443 were turned off then another vhost for another project would answe=
r the request and there would still be a warning.
>
> If a *.openoffice.org certificate were purchased it would be secondary to=
 *.apache.org and older browsers would still have trouble. I've setup multi=
ple certificates on httpd at work and know this to be so. No way the ASF wi=
ll put the *.openoffice.org certificate (if purchased) first.
>
> We can do a rewrite of https traffic to http but that happens after the h=
andshake and the security warning.
>
> I doubt that this razor fine point is worth the effort and the tradeoff o=
f increased complexity for Infrastructure.
>

Probably no use for SSL site wide, but we do have a small number of
pages where we would benefit, like the login/registration pages for
the openoffice.org domain wiki and the support forums.

> If we had a view of what browsers are used and how much is https we can m=
easure the impact and determine if effort here is worth it.
>
>>
>>> And if in the end the most sensible solution is that we acquire a
>>> certificate for *.openoffice.org , this is surely something the PMC and
>>> Infra can look into. But it would be good to see the discussion in the
>>> issue page converge.
>
> That discussion is there in the JIRA. You can see the bit above. It is an=
 incremental improvement effective for modern browsers.
>
> Regards,
> Dave
>
>>>
>>> Regards,
>>>   Andrea.
>>>
>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: ooo-users-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: ooo-users-help@incubator.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: ooo-users-unsubscribe@incubator.apache.org
> For additional commands, e-mail: ooo-users-help@incubator.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: ooo-users-unsubscribe@incubator.apache.org
For additional commands, e-mail: ooo-users-help@incubator.apache.org