{"action":"created","issue":{"url":"https://api.github.com/repos/sprin/pg-discuss/issues/9","labels_url":"https://api.github.com/repos/sprin/pg-discuss/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/sprin/pg-discuss/issues/9/comments","events_url":"https://api.github.com/repos/sprin/pg-discuss/issues/9/events","html_url":"https://github.com/sprin/pg-discuss/issues/9","id":110922936,"number":9,"title":"Get SSL certificate from issuer trusted by browser vendors for demo at pg-discuss-demo.sprin.io","user":{"login":"sprin","id":1452117,"avatar_url":"https://avatars.githubusercontent.com/u/1452117?v=3","gravatar_id":"","url":"https://api.github.com/users/sprin","html_url":"https://github.com/sprin","followers_url":"https://api.github.com/users/sprin/followers","following_url":"https://api.github.com/users/sprin/following{/other_user}","gists_url":"https://api.github.com/users/sprin/gists{/gist_id}","starred_url":"https://api.github.com/users/sprin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sprin/subscriptions","organizations_url":"https://api.github.com/users/sprin/orgs","repos_url":"https://api.github.com/users/sprin/repos","events_url":"https://api.github.com/users/sprin/events{/privacy}","received_events_url":"https://api.github.com/users/sprin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/sprin/pg-discuss/milestones/1","html_url":"https://github.com/sprin/pg-discuss/milestones/1.0","labels_url":"https://api.github.com/repos/sprin/pg-discuss/milestones/1/labels","id":1343104,"number":1,"title":"1.0","description":"Milestone for first PyPI release.","creator":{"login":"sprin","id":1452117,"avatar_url":"https://avatars.githubusercontent.com/u/1452117?v=3","gravatar_id":"","url":"https://api.github.com/users/sprin","html_url":"https://github.com/sprin","followers_url":"https://api.github.com/users/sprin/followers","following_url":"https://api.github.com/users/sprin/following{/other_user}","gists_url":"https://api.github.com/users/sprin/gists{/gist_id}","starred_url":"https://api.github.com/users/sprin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sprin/subscriptions","organizations_url":"https://api.github.com/users/sprin/orgs","repos_url":"https://api.github.com/users/sprin/repos","events_url":"https://api.github.com/users/sprin/events{/privacy}","received_events_url":"https://api.github.com/users/sprin/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":3,"state":"open","created_at":"2015-10-07T17:02:59Z","updated_at":"2015-10-12T09:23:25Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-10-12T07:44:36Z","updated_at":"2015-10-12T09:23:25Z","closed_at":"2015-10-12T09:23:25Z","body":"Firefox refuses to load the demo when HTTPS is used. The browser refuses to retrieve the JS file for the client. No user-visible warning is issued, but the developer tools reveal an error:\r\n> pg-discuss-demo.sprin.io uses an invalid security certificate.\r\n>\r\n> The certificate is not trusted because the issuer certificate is unknown.\r\n> The server might not be sending the appropriate intermediate certificates.\r\n> An additional root certificate may need to be imported.\r\n>\r\n> (Error code: sec_error_unknown_issuer)\r\n\r\nChrome shows the same behavior, but with more obscure error message:\r\n> demo.html:104 GET https://pg-discuss-demo.sprin.io/embed.min.js net::ERR_INSECURE_RESPONSE\r\n\r\nWithout even being presented an option to accept the self-signed certificate, visitors to the demo cannot be expected to work around this.\r\n\r\nThe initial plan was to obtain a free certificate from [Let's Encrypt](https://letsencrypt.org/), a free and open CA that will be trusted by browsers courtesy of a [cross-signature from IdenTrust](https://letsencrypt.org/certificates/). However they have [pushed back the schedule for general availability to the week of Nov 16](https://letsencrypt.org/2015/08/07/updated-lets-encrypt-launch-schedule.html).\r\n\r\nTo get this fixed now, we will need to procure a certificate from a commercial CA."},"comment":{"url":"https://api.github.com/repos/sprin/pg-discuss/issues/comments/147345929","html_url":"https://github.com/sprin/pg-discuss/issues/9#issuecomment-147345929","issue_url":"https://api.github.com/repos/sprin/pg-discuss/issues/9","id":147345929,"user":{"login":"sprin","id":1452117,"avatar_url":"https://avatars.githubusercontent.com/u/1452117?v=3","gravatar_id":"","url":"https://api.github.com/users/sprin","html_url":"https://github.com/sprin","followers_url":"https://api.github.com/users/sprin/followers","following_url":"https://api.github.com/users/sprin/following{/other_user}","gists_url":"https://api.github.com/users/sprin/gists{/gist_id}","starred_url":"https://api.github.com/users/sprin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sprin/subscriptions","organizations_url":"https://api.github.com/users/sprin/orgs","repos_url":"https://api.github.com/users/sprin/repos","events_url":"https://api.github.com/users/sprin/events{/privacy}","received_events_url":"https://api.github.com/users/sprin/received_events","type":"User","site_admin":false},"created_at":"2015-10-12T09:23:25Z","updated_at":"2015-10-12T09:23:25Z","body":"Done. A [modern ciphersuite](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility) and HSTS are in place, but I don't think it is worth the effort to enable Public Key Pinning for this. Firefox and Chrome no longer have errors related to the cert.\r\n\r\nFirefox \"Security Tab\" shows:\r\n```\r\nConnection:\r\nProtocol version: TLSv1.2\r\nCipher suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\r\nHost pg-discuss-demo.sprin.io:\r\nHTTP Strict Transport Security: Enabled\r\nPublic Key Pinning: Disabled\r\nCertificate:\r\nIssued To\r\nCommon Name (CN): pg-discuss-demo.sprin.io\r\nOrganization (O): <Not Available>\r\nOrganizational Unit (OU): Domain Control Validated\r\nIssued By\r\nCommon Name (CN):COMODO RSA Domain Validation Secure Server CA\r\nOrganization (0): COMODO CA Limited\r\nOrganizational Unit (OU): <Not Available>\r\nPeriod of Validity\r\nBegins On: 10/11/2015\r\nExpires On: 10/11/2016\r\n```"}}