SSL Certificate only valid only valid for modules.ceylon-lang.org

[EdShaw]

I'm having an issue accessing the Ceylon website over https:

I've tried via two separate connections (over this public wifi, and over this public wifi via VPN), with the same results both times. I see the issue in both Chrome 41 and Firefox ESR 31.5.0 (both OS X 10.9.5).

Not sure if this is a more widespread issue or not. Let me know of any further debugging steps you may require to resolve this.

[lucaswerkmeister]

Not a recent breakage. @FroMage can we please have HTTPS everywhere?

[FroMage]

There was a reason for that IIRC. It has to do with having a single IP and virtual hosts so we have to pick a certificate first and then we can decode the Host header and route to www or modules and we don't have a certificate for www anyways, so we pick the one for modules where it's relevant. Not sure we'd gain anything from having SSL for the static web site, so I think I'll just ask for a new IP and stop listening on the https port for the static web site.

[emmanuelbernard]

Isn't there nowadays a good enough solution for multiple domains - 1 IP for https traffic? I know we would lose people on XP but, is that a trouble.

[FroMage]

I think it's an architecture issue that you can't have multiple SSL domains over virtual hosts. It's just not possible AFAIK. As in, not an implementation issue but a protocol issue. Virtual hosts work by checking the Host header and you can't decode it until you have an SSL connection, so it's a chicken and egg problem.

[lucaswerkmeister]

It’s a solved chicken-and-egg problem. Server Name Indication.

[lucaswerkmeister]

Alternatively, get one certificate for ceylon-lang.org + *.ceylon-lang.org, and serve that certificate for everything. How expensive are wildcard certificates with your CA?

[FroMage]

Mmm, interesting. Last time I looked at this problem, this solution did not exist ;)

[FroMage]

Well, I guess we have to ask for new certificates then.

[lucaswerkmeister]

Any updates?

[FroMage]

We now have valid certificates but can't migrate until #354 is done as that would break the web IDE. Going to close this issue though, as the other one is the one we need fixed.