Please enable ssl/https support for the beta wikis again. It is missing after migration to eqiad.
Btw: The old cert issued by Labs CA for all beta subdomains was not considered "valid" because among others things it was only for issued for *.wmflabs.org (counts only for direct subdomain) but thats ok.
see bug 48501 for task to get real beta certs but only for limited subdomains.
Version: unspecified
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=68387
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T53494 Use Beta cluster as a true canary for code deployments (epic) | |||
| Resolved | • csteipp | T61141 Get OAuth working in beta | |||
| Resolved | hashar | T65538 enable SSL/https support again | |||
| Resolved | Krenair | T50501 beta: Get SSL certificates for *.{projects}.beta.wmflabs.org | |||
| Restricted Task |
Change 124057 had a related patch set uploaded by Hashar:
beta: adjust protoproxy for eqiad
While applying the puppet class on deployment-cache-bits01, nginx ends up bailing out with:
root@deployment-cache-bits01:~# /etc/init.d/nginx start
Starting nginx: nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/private/star.wmflabs.org.key") failed
(SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
nginx: configuration file /etc/nginx/nginx.conf test failed
The puppet class role::protoproxy::ssl::beta is applied on all varnish instances. Nginx refuses to starts because the /etc/ssl/private/star.wmflabs.org.key key mismatch (see comment #3). That would be solved whenever we get certificates on beta which is the rather long bug 48501.
REOPEN: bug 48501 is about getting real, valid certs. This about accessing beta with https (regardless if the cert is valid for the browser and a warning message pops up).
I don't know nginx to say why he doesn't like the cert, but how about generating new, self-signed or by Labs CA for beta domains? Thats how it was and worked in pmtpa, so what's the problem here?
(In reply to se4598 from comment #6)
appendix: even if the mentioned bug now covers that too, leave this bug open until it's somehow working, because of the dependencies/blocked bug of this etc.
SSL is enabled again but is not going to work until someone sort out the SSL certificate issue tracked by bug 48501. There is no need to have two bugs to track the issue :-D