Subject: Re: Moving to HTTPS
To: =?UTF-8?Q?Mikael_Kjellstr=c3=b6m?= <mikael.kjellstrom@mksoft.nu>
References: <89d566b4-58fb-c1e9-97ef-46d4d915b86c@dunslane.net>
 <20170107215523.GA294152@tornado.leadboat.com>
 <96080bc2-086f-c47f-6cee-b7f00a9bcd38@2ndQuadrant.com>
 <3104.1483834327@sss.pgh.pa.us>
 <a04ba257-712f-b47e-54bd-a2ee1087f014@2ndQuadrant.com>
 <7217.1484469582@sss.pgh.pa.us>
 <9535692b-fe3d-18fc-0080-68914f1bf7f1@2ndQuadrant.com>
 <20502717-9946-d876-2301-9f32ac5b48f6@mksoft.nu>
Cc: Andrew Dunstan <andrew.dunstan@2ndquadrant.com>,
 Tom Lane <tgl@sss.pgh.pa.us>, buildfarm-members@postgresql.org,
 buildfarm-admins@postgresql.org
From: Stefan Kaltenbrunner <stefan@kaltenbrunner.cc>
Message-ID: <2be4be1b-d971-53f0-4d26-410728140418@kaltenbrunner.cc>
Date: Mon, 16 Jan 2017 10:24:58 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Icedove/45.5.1
MIME-Version: 1.0
In-Reply-To: <20502717-9946-d876-2301-9f32ac5b48f6@mksoft.nu>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
Sender: buildfarm-members-owner@postgresql.org

On 01/15/2017 03:09 PM, Mikael Kjellström wrote:
> On 2017-01-15 14:59, Andrew Dunstan wrote:
>
>> The test should be thorough enough. If you want to try it for real and
>> you're using the same that you built against, just change the URLs in
>> your config file, i.e.:
>>
>>     sed -i -e
>> s,http://www.pgbuildfarm.org/,https://buildfarm.postgresql.org/,
>> your-config-file
>
> I tried to surf to:
>
> https://pgbuildfarm.org/
>
> and I am getting that the certificate is invalid.  I see that you are
> using let's encrypt service for the SSL-certificate.  Just configure it
> to include all the DNS-names that you are using.   Currently the
> installed certificate is configured for the DNS-name:
>
> buildfarm.postgresql.org
>
> and with the SAN:
>
> DNS Name: brentalia.postgresql.org
> DNS Name: buildfarm.postgresql.org
>
> I would suggest adding pgbuildfarm.org, www.pgbuildfarm.org etc also as
> SAN:s.

Thanks for the suggestion, but that is not easily doable in our current 
infrastructure - our letsencrypt deployment is fully automated and 
completely integrated with our internal config management and nameserver 
infrastructure and therefor only works with domains we also host and 
manage through/on pginfra.


regards


Stefan


-- 
Sent via buildfarm-members mailing list (buildfarm-members@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/buildfarm-members