[savannah-help-public] [sr #109455] www.nongnu.org and nongnu.org hostname mismatch with certificate

[anonymous]

URL:
<http://savannah.gnu.org/support/?109455>

Summary: www.nongnu.org and nongnu.org hostname mismatch with
certificate
Project: Savannah Administration
Submitted by: None
Submitted on: Sun 28 Jan 2018 12:19:15 AM UTC
Category: Project webpages
Priority: 5 - Normal
Severity: 6 - Security
Status: None
Assigned to: None
Originator Email:
Operating System: None
Open/Closed: Open
Discussion Lock: Any

_______________________________________________________

Details:

https://www.nongnu.org/ and https://nongnu.org/ have a working Let's Encrypt
certificate, but these two particular domain names are missing from its
alternative domain list, so clients won't accept it do to 'hostname mismatch'
error and therefore HTTPS cannot be used.

Adding www.nongnu.org and nongnu.org to the list of domain names covered by
the certificate would most likely resolve this.





_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109455>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[anonymous]

Follow-up Comment #1, sr #109455 (project administration):

Test results:
https://dev.ssllabs.com/ssltest/analyze.html?d=www.nongnu.org&hideResults=on&latest


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109455>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Bob Proulx]

Update of sr #109455 (project administration):

Open/Closed: Open => Closed

_______________________________________________________

Follow-up Comment #2:

Since this was posted anonymously there is no way to contact the submitter.
Perhaps they will check back in and read the logs later?

Yes. This has been known since last week. The admins haven't gotten the
certificate problem figured out yet.

This isn't anything that Savannah folks can do anything about since it is on
the FSF administered systems and not the Savannah systems. As such I am
closing this bug ticket since there isn't anything we can do about it here.
This is already a known issue for the FSF but if you wish now or in the future
please file a bug ticket with them at sysadmin AT gnu.org .


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109455>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[anonymous]

Follow-up Comment #3, sr #109455 (project administration):

Hi Bob, Thank you for your answer. I'm going to forward this report to the FSF
team you pointed to. It'd be important to fix this, because currently all
hosted nongnu project pages (often including source and binary downloads) are
offered via cleartext HTTP only.

_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109455>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/