mainSavannah Administration - Support: sr #108776, ssl updates?

 
 

sr #108776: ssl updates?

Submitter:  Karl Berry <karl>
Submitted:  Mon 23 Mar 2015 05:56:20 PM UTC
   
 
Category:  Savannah website Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  rwp
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 04 Apr 2015 05:12:46 AM UTC, comment #3: 

I think the main issue has been addressed with the addition of the additional certificate to Savannah to make wget happy with both certificate chains.  The fencepost certificates were upgraded.  That leaves only the ciphers available on Savannah.  That is well known and lingering issue but probably no need to track it here.

Bob Proulx <rwp>
Site Administrator
Wed 25 Mar 2015 07:39:24 AM UTC, comment #2: 

There is at least two separate issues.  One is that the installed ca-certificates on fencepost are out of date and need to be updated.  I filed a sysadmin request to have that done.  For this ticket I am going to assume that happens.  I think that is necessary but I don't think that is sufficient.

Second is whether Savannah is providing a valid trust chain.  One certificate is listed as an additional download.  That may be breaking the trust chain.  However when I have ssllabs test www.fsf.org it reports exactly the same extra download for that trust chain too.  But when I test both savannah.gnu.org and www.fsf.org using wget the result is that www.fsf.org validates but savannah.gnu.org does not.  Therefore something must be different and incorrect about the savannah.gnu.org trust chain.

Third are the SSL features available for Savannah.  This is going to be an ongoing problem due to everything being connected.  The first thought would be to simply upgrade the system.  However having tested that I find several things break.  Among them being the Xen VM bootstrap process is broken likely leaving us with an unbootable system and that is just the start.  There is a laundry list of things that are upgrade-broken.  I have requested a clean VM in which to transfer services so that we could get things upgrade clean but so far nothing has been provided.

I am right now looking at both the trust chain and the cipher situation.

Bob Proulx <rwp>
Site Administrator
Mon 23 Mar 2015 05:58:46 PM UTC, comment #1: 

Actually, I guess I'm wrong and Reed is right, it's Ineiev's cron jobs on fencepost that were failing (see quoted msg in Reed's msg).  I don't know if the problem can/should be solved on fencepost or on savannah.

But the cipher stuff is surely about savannah, anyway.

Karl Berry <karl>
Site Administrator
Mon 23 Mar 2015 05:56:20 PM UTC, original submission:  

According to the ssllabs.com test at https://www.ssllabs.com/ssltest/analyze.html?d=savannah.gnu.org, there is a minor ca issue and better ciphers could be enabled.  As reported by Reed Loden at http://lists.gnu.org/archive/html/savannah-users/2015-03/msg00002.html.  Bob?

(Reed talks about fencepost in that msg, but that's a misunderstanding. It's all savannah.)

Karl Berry <karl>
Site Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by karl (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-04-04 rwp StatusNone Done
        Assigned toNone rwp
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code