RobH has uploaded a new change for review.
https://gerrit.wikimedia.org/r/109118
Change subject: blog.w.o to use own certificate, not wildcard
......................................................................
blog.w.o to use own certificate, not wildcard
holmium was using our wildcard certificate to host the blog. I've
changed it to use its own certificate, for reasons defined in the linked
RT ticket. The change will also stop techblog.wikimedia.org from
rewriting via HTTPS, but that is depreciated from before the blogs were
merged years ago. I have left the http techblog vhost intact, as it
doesn't cost anything to do so at this time.
Change-Id: I33dff01e66af68796fbbadad8bd40a6f8a769b55
RT: 5010
---
M files/apache/sites/blog.wikimedia.org
A files/ssl/blog.wikimedia.org.pem
M manifests/misc/blogs.pp
3 files changed, 34 insertions(+), 26 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/18/109118/1
diff --git a/files/apache/sites/blog.wikimedia.org
b/files/apache/sites/blog.wikimedia.org
index 4717cde..b5c4364 100644
--- a/files/apache/sites/blog.wikimedia.org
+++ b/files/apache/sites/blog.wikimedia.org
@@ -61,8 +61,8 @@
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite
AES128-GCM-SHA256:RC4-SHA:RC4-MD5:DES-CBC3-SHA:AES128-SHA:AES256-SHA
SSLHonorCipherOrder on
- SSLCertificateFile /etc/ssl/certs/star.wikimedia.org.pem
- SSLCertificateKeyFile /etc/ssl/private/star.wikimedia.org.key
+ SSLCertificateFile /etc/ssl/certs/blog.wikimedia.org.pem
+ SSLCertificateKeyFile /etc/ssl/private/blog.wikimedia.org.key
SSLCACertificatePath /etc/ssl/certs/
<Directory />
@@ -114,26 +114,4 @@
RewriteRule ^/$ http://blog.wikimedia.org/c/global/ [R=301]
RewriteCond %{HTTP_HOST} ^blog.wikimediafoundation.org
RewriteRule ^/$ http://blog.wikimedia.org/ [R=301]
-</VirtualHost>
-
-<VirtualHost *:443>
- ServerAdmin [email protected]
- ServerName techblog.wikimedia.org
- SSLEngine on
- SSLCertificateFile /etc/ssl/certs/star.wikimedia.org.pem
- SSLCertificateKeyFile /etc/ssl/private/star.wikimedia.org.key
- SSLCACertificatePath /etc/ssl/certs/
-
- ServerAlias communityblog.wikimedia.org globalblog.wikimedia.org
blog.wikimediafoundation.org
- RewriteEngine On
- RewriteRule ^/feed/(.*)
https://blog.wikimedia.org/c/technology/feed/$1 [R=301]
- RewriteRule ^/category/(.*) https://blog.wikimedia.org/c/$1
[R=301]
- RewriteRule ^/20(.*) https://blog.wikimedia.org/20$1 [R=301]
- RewriteRule ^/wp-content/(.*)
https://blog.wikimedia.org/wp-content/$1 [R=301]
- RewriteCond %{HTTP_HOST} ^communityblog.wikimedia.org
- RewriteRule ^/$ https://blog.wikimedia.org/c/community/ [R=301]
- RewriteCond %{HTTP_HOST} ^techblog.wikimedia.org
- RewriteRule ^/$ https://blog.wikimedia.org/c/technology/
[R=301]
- RewriteCond %{HTTP_HOST} ^blog.wikimediafoundation.org
- RewriteRule ^/$ https://blog.wikimedia.org/ [R=301]
-</VirtualHost>
+</VirtualHost>
\ No newline at end of file
diff --git a/files/ssl/blog.wikimedia.org.pem b/files/ssl/blog.wikimedia.org.pem
new file mode 100644
index 0000000..e0ebcf3
--- /dev/null
+++ b/files/ssl/blog.wikimedia.org.pem
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFKjCCBBKgAwIBAgIDED6tMA0GCSqGSIb3DQEBBQUAMDwxCzAJBgNVBAYTAlVT
+MRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEUMBIGA1UEAxMLUmFwaWRTU0wgQ0Ew
+HhcNMTQwMTIxMTcxMjQzWhcNMTcwOTA3MDg1ODUxWjCBwTEpMCcGA1UEBRMgL2lt
+YUc3Nm1RUkI5bHFJWEQ3bGFySkJDNXZpTWJPSHkxEzARBgNVBAsTCkdUODQ5NTA3
+ODAxMTAvBgNVBAsTKFNlZSB3d3cucmFwaWRzc2wuY29tL3Jlc291cmNlcy9jcHMg
+KGMpMTMxLzAtBgNVBAsTJkRvbWFpbiBDb250cm9sIFZhbGlkYXRlZCAtIFJhcGlk
+U1NMKFIpMRswGQYDVQQDExJibG9nLndpa2ltZWRpYS5vcmcwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDAmZxUGcX6Ef/CGvvyKBBl5tJ/b7kV37i9hlXO
+xYyeIokyNKORqV7g0GncJ2wfSqAQAZyIT5mtwzDzU6mZtRLjG1qvKpoAsg/hITR/
+dkx+tGZ4aUFrvhCO+XqXizYl/5Delgx6LAJyysizaNMvBSCP1EYQkYpwDRbmEmIM
+ipP8AMOAakCbaaQxZCbnedPpfiFFRHAi+zQbnev5CtIx4ndIX1HDntGoV7c/B9Kq
+jw4XQWwZBIdzlW+I97UBGotIhI8Zn+oABz31qsSPxSbuBvbVS8W0Hr16TSvgRsQC
+htqw8JaRE+hIrCjZvMVLPICdB7fPZzP7KHFrCb7Ica+qcqJ7AgMBAAGjggGtMIIB
+qTAfBgNVHSMEGDAWgBRraT1qGEJK3Y8CZTn9NSSGeJEWMDAOBgNVHQ8BAf8EBAMC
+BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdEQQWMBSCEmJs
+b2cud2lraW1lZGlhLm9yZzBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vcmFwaWRz
+c2wtY3JsLmdlb3RydXN0LmNvbS9jcmxzL3JhcGlkc3NsLmNybDAdBgNVHQ4EFgQU
+VvZZyj+io9ZBClj52kl549vtGHAwDAYDVR0TAQH/BAIwADB4BggrBgEFBQcBAQRs
+MGowLQYIKwYBBQUHMAGGIWh0dHA6Ly9yYXBpZHNzbC1vY3NwLmdlb3RydXN0LmNv
+bTA5BggrBgEFBQcwAoYtaHR0cDovL3JhcGlkc3NsLWFpYS5nZW90cnVzdC5jb20v
+cmFwaWRzc2wuY3J0MEwGA1UdIARFMEMwQQYKYIZIAYb4RQEHNjAzMDEGCCsGAQUF
+BwIBFiVodHRwOi8vd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvY3BzMA0GCSqG
+SIb3DQEBBQUAA4IBAQC+rFaX4bjN/m4v8VC79p+2bgjdc52XsUBEwNxfJqh8z7B9
+usJMESvVe0SKx7v6ORkzddzukO+wU2U3GBGdvT7r4EnFjK518QlT8NDeXkWl62oR
+EI7c8vWVoCz3Q0XNwDh8jXgp/Rl6+vEG0DARDxZ7TtqAXXnZaT7KRn24bcSHNVLB
+Q89v5bZ1s2IK4bjHhMAGeu64LlePVHXCShXRoanRBqv6t4shlVdjIzcac2wHdR3H
+c5K7hyetimle1VDqslF2XX6pm7TyGfBmMuITJA6uPg6tp8B5HTucmXhRh2URYPUM
+zvZStzdznpeARYcZopfrhB9BUioyTErZT51mIiq8
+-----END CERTIFICATE-----
diff --git a/manifests/misc/blogs.pp b/manifests/misc/blogs.pp
index a677d7c..863b821 100644
--- a/manifests/misc/blogs.pp
+++ b/manifests/misc/blogs.pp
@@ -32,7 +32,7 @@
include nrpe
class { 'memcached': memcached_ip => '127.0.0.1' }
- install_certificate{ 'star.wikimedia.org': }
+ install_certificate{ 'blog.wikimedia.org': }
# There's not really a good reason for this to be "",
# except that it was like that when I found it.
--
To view, visit https://gerrit.wikimedia.org/r/109118
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I33dff01e66af68796fbbadad8bd40a6f8a769b55
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: RobH <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
