<p dir="ltr">If this is about keeping the cost low, why don't you buy one wildcard certificate for *.<a href="http://gpg4win.org">gpg4win.org</a> and just create tons of subdomains to <a href="http://gpg4win.org">gpg4win.org</a> and redirect all https requests to various web addresses you use to <a href="http://list.gpg4win.org">list.gpg4win.org</a>, <a href="http://de.gpg4win.org">de.gpg4win.org</a>, <a href="http://www.gpg4win.org">www.gpg4win.org</a>, etc. You can still keep the same servers on the various current domains too, just make the web servers redirect each https request to a subdomain under <a href="http://gpg4win.org">gpg4win.org</a> while still letting http go through. This won't break any existing links found on the Internet, and will make it easier for you in the future to gather everything under one good looking domain <a href="http://gpg4win.org">gpg4win.org</a> and skip using various domains for http requests too whenever you feel the time is ready.<br>
A web server with one IP can have alot of domains pointing towards it so this is a workaround if you only want to buy one single wildcard certificate.</p>
<p dir="ltr">I don't see the certificate issue as the real problem here, but rather that the people working on the gpg4win project over time have scattered things under too many domains, and it doesn't look good and it's less practical in the long run to keep it this way so why not take steps towards facilitating a migration to having everything under one domain anyway?</p>
<p dir="ltr">Good luck with all this! It can be time consuming but it's worth it!</p>
<p dir="ltr">/David</p>
<div class="gmail_quote">Den 15 okt 2015 16:05 skrev "Thomas Arendsen Hein" <<a href="mailto:thomas@intevation.de">thomas@intevation.de</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi!<br>
<br>
There has been some discussion about SSL/TLS certificate that are<br>
automatically accepted by usual web browsers on this list (and<br>
elsewhere).<br>
<br>
TL;DR: We want to switch to a commercial SSL certificate for<br>
the gpg4win web and download services soon. Mailing list and forum<br>
will not yet be changed.<br>
<br>
<br>
= The current situation =<br>
<br>
The current certificate is provided by our own CA, which is not<br>
known by most browers unless the root certificate is imported from<br>
<a href="https://ssl.intevation.de/" rel="noreferrer" target="_blank">https://ssl.intevation.de/</a><br>
<br>
* Why don't we just buy a certificate?<br>
<br>
We currently have to do this, because the certificate includes<br>
over 40 SAN entries (including a wildcard entry) in a single<br>
certificate: <a href="http://wald.intevation.org" rel="noreferrer" target="_blank">wald.intevation.org</a>, *.<a href="http://wald.intevation.org" rel="noreferrer" target="_blank">wald.intevation.org</a> and many<br>
entries for the projects hosted on Wald.<br>
<br>
I'm not aware of any commercial CA that offers such certificates,<br>
I have only found CAs which offer 24 SAN entries, and then they<br>
don't allow wildcard entries.<br>
<br>
* Why don't we simply use more IPs?<br>
<br>
IPv4 IPs are a scarce resource, we don't want to waste them. But<br>
we tried adding some extra IPs to our Wald server to have separate<br>
SSL certificates for the most important services:<br>
- *.<a href="http://wald.intevation.org" rel="noreferrer" target="_blank">wald.intevation.org</a> and <a href="http://wald.intevation.org" rel="noreferrer" target="_blank">wald.intevation.org</a><br>
- the 4 gpg4win hostnames currently hosted on Wald (<a href="http://gpg4win.org" rel="noreferrer" target="_blank">gpg4win.org</a>,<br>
<a href="http://gpg4win.de" rel="noreferrer" target="_blank">gpg4win.de</a> and both prefixed with "www.")<br>
- everything else (using a certificate signed by our own CA, like<br>
the current one)<br>
<br>
The main problem here was the templating mechanism of FusionForge<br>
for the web server configuration files for Wald. Some early<br>
attempts to adjust this failed, and because or admin capacities<br>
were needed in other projects, we did not continue with this<br>
approach. It certainly is possible, but might be too<br>
time-consuming. If adjusting Wald fails, we could use a<br>
workaround: A simple proxy or TCP forwarder in front of Wald, but<br>
at that time, Wald was under heavy load and we did not want to add<br>
extra overhead for a workaround. Since then we upgraded to more<br>
powerful hardware, so this might be possibility for the future.<br>
<br>
* Why don't we simply use SNI to present different certificates?<br>
<br>
1. Same reasons as above: We need to adjust the FusionForge<br>
templating or add a proxy/forwarder as a workaround.<br>
2. SNI has only very recently become supported by most browsers<br>
and there is still some software that does not support SNI:<br>
- Internet Explorer on Windows XP (should not be relevant<br>
anymore, but unfortunately it is)<br>
- older wget (as included in the still supported Debian wheezy)<br>
- Python before 2.7.9 (again Debian wheezy)<br>
- Mercurial before version 3.3 (Debian jessie has 3.1.2)<br>
- Java 6 (even at the current patch level)<br>
- Not sure if Android 2.x still counts, but I mention it for<br>
completeness<br>
<br>
I want to use SNI in the future, but I assume this still has to<br>
wait a bit for getting Windows XP with IE usage below 1% and<br>
maybe even Debian jessie becoming oldstable.<br>
<br>
<br>
= The proposed next step for gpg4win =<br>
<br>
My plan is to buy a certificate with the following SAN entries:<br>
<br>
<a href="http://www.gpg4win.org" rel="noreferrer" target="_blank">www.gpg4win.org</a> (main address)<br>
<a href="http://www.gpg4win.de" rel="noreferrer" target="_blank">www.gpg4win.de</a><br>
<a href="http://gpg4win.org" rel="noreferrer" target="_blank">gpg4win.org</a><br>
<a href="http://gpg4win.de" rel="noreferrer" target="_blank">gpg4win.de</a><br>
<a href="http://files.gpg4win.org" rel="noreferrer" target="_blank">files.gpg4win.org</a><br>
<a href="http://files.gpg4win.de" rel="noreferrer" target="_blank">files.gpg4win.de</a><br>
<br>
With a lifetime of three years, this will cost us 640€ for a<br>
certificate from GeoTrust (see below for why we use GeoTrust).<br>
<br>
The certificate will be installed on the server that currently hosts<br>
<a href="http://files.gpg4win.org" rel="noreferrer" target="_blank">files.gpg4win.org</a>, so downloads from there will immediately become<br>
trusted without importing Intevation's CA.<br>
<br>
I will upgrade the server so it can offer TLS1.2, like Wald already<br>
does.<br>
<br>
As the content of <a href="http://www.gpg4win.org" rel="noreferrer" target="_blank">www.gpg4win.org</a> is generated into static files,<br>
moving the gpg4win website to this server is easy. Updating the<br>
website can be done by the same people who can publish new releases,<br>
but others can be added if needed, too.<br>
<br>
If there are no objections, I can start with this.<br>
<br>
<br>
= Future steps =<br>
<br>
The mailing lists are currently hosted on Wald. As most mails sent<br>
to and received from the list are transferred via unprotected SMTP<br>
connections, having SSL would be nice (especially for the Mailman<br>
web interface), but is less important than website and downloads.<br>
<br>
A possible solution could be to move the mailing lists to<br>
<a href="http://lists.gnupg.org" rel="noreferrer" target="_blank">lists.gnupg.org</a>, which already provides a certificate signed by a CA<br>
known to modern browsers.<br>
<br>
But this would not solve secure access to the web forums on Wald and<br>
most solutions for the forums would also provide a solution for the<br>
mailing list.<br>
<br>
I assume the most appropriate solution would be to buy a wildcard<br>
certificate for Wald, which would cost 1380€ for three years for the<br>
certificate and the additional required IPv4 IP, and solve or<br>
work around the FusionForge templating mechanism.<br>
<br>
<br>
= Comments on alternative CAs =<br>
<br>
Yes, there are cheaper CAs than GeoTrust, but it has some benefits<br>
that others can't offer us:<br>
<br>
- It is a well-known CA that is accepted by all relevant browsers<br>
and other https clients.<br>
- A German reseller that sends us a single invoice for all<br>
certificates we have bought, so our accounting does not run into<br>
issues or has to pay a separate invoice for each certificate.<br>
Despite having our own CA, we have bought many certificates for<br>
customers and some of our other servers.<br>
- Because of this it can't happen that our credit card gets charged<br>
beyond the monthly limit and will leave our CEO stranded somewhere :)<br>
- If things go wrong, we can call a real human!<br>
- We can buy certificates for domains or subdomains, that we do not<br>
own. This applies to the gpg4win domains, too. GeoTrust will<br>
contact the owner and ask for permission.<br>
- It is not Comodo, see e.g.<br>
<a href="https://en.wikipedia.org/wiki/Comodo_Group#Certificate_hacking" rel="noreferrer" target="_blank">https://en.wikipedia.org/wiki/Comodo_Group#Certificate_hacking</a><br>
so it is less likely that your sysadmin has marked it as<br>
untrusted.<br>
- It is still cheaper than some other CAs which offer a similar<br>
level of quality.<br>
<br>
<br>
Whew! That was long. Thanks for reading (or skimming). Feel free to<br>
contact me via this list (I subscribed some weeks ago) if you have<br>
questions or comments.<br>
<br>
Regards,<br>
Thomas Arendsen Hein<br>
<br>
--<br>
<a href="mailto:thomas@intevation.de">thomas@intevation.de</a> - <a href="http://intevation.de/~thomas/" rel="noreferrer" target="_blank">http://intevation.de/~thomas/</a> - OpenPGP key: 0x5816791A<br>
Intevation GmbH, Neuer Graben 17, 49074 Osnabrueck - AG Osnabrueck, HR B 18998<br>
Geschaeftsfuehrer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner<br>
<br>_______________________________________________<br>
Gpg4win-users-en mailing list<br>
<a href="mailto:Gpg4win-users-en@wald.intevation.org">Gpg4win-users-en@wald.intevation.org</a><br>
<a href="https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/gpg4win-users-en" rel="noreferrer" target="_blank">https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/gpg4win-users-en</a><br></blockquote></div>