Author: daniel
Description:
While Bug#52630 was fixed and
http://www.sslshopper.com/ssl-checker.html#hostname=tools.wmflabs.org
has an all green result
http://www.sslshopper.com/ssl-checker.html#hostname=fastcci1.wmflabs.org
gives a warning ("The certificate is not trusted in all web browsers.")
The latter goes through a different server (the Instance Proxy).
Version: unspecified
Severity: normal
It is the dynamic proxy, which uses the star.wmflabs.org certificate, which I presume needs to be fixed.
Change 111342 had a related patch set uploaded by Tim Landscheidt:
Dynamic proxy: Serve SSL certificate chain
Change 111386 had a related patch set uploaded by Jeremyb:
Dynamic proxy: Serve SSL certificate chain. v2
Close, but no cigar. While using .chained.pem in the Nginx configuration is apparently The Right Thing(TM), the problem lies deeper: manifests/certs.pp's install_certificate creates the chained certificate for star.wmflabs.org with wmf-labs.pem, while the certificate is actually signed by RapidSSL_CA.pem. The patch by jeremyb should fix this.
I've noticed that in Firefox with a fresh profile this will lead to users getting the scary looking "This connection is untrusted" message. For something like accounts.wmflabs.org that routinely deals with new users to the project who may not be very tech savvy, this could be a problem.
Firefox isn't showing it as invalid now with a fresh profile, and http://www.sslshopper.com/ssl-checker.html#hostname=fastcci1.wmflabs.org is showing all green.