Hi Samuel,

thanks for noticing. I had set up the scripting to upload the entire chain to 
the load balancer, but apparently it ignores the intermediate in that process. 
So I now set the intermediate in it's intermediate store, and it seems it's 
working now.

I also noticed ssllabs complaining about weak DH parameters. Unfortunately I 
can't set those per service, and globally setting DH keys longer than 1024 
would break some sites that rely on connectivity with older clients. But I 
changed the ciphersuites set in favor of ECDHE instead of DHE, which also 
solves this. Java 6 could have a problem with this, but I guess (and hope) 
nobody's still using that to run Eclipse or something.

I also set a CAA DNS record, and now we've got an A rating :)

Can you please check if you can access without problems now?    

Thanks
Maik


> Am 23.02.2018 um 01:38 schrieb Samuel Pelletier <sam...@samkar.com>:
> 
> Hi Maik,
> 
> I think there is a missing chain cert on the server.
> 
> At least Eclipse update refuse to connect to the update site with this error:
> Unable to read repository at 
> https://jenkins.wocommunity.org/job/WOLips47/lastSuccessfulBuild/artifact/temp/dist/content.xml
>  
> <https://jenkins.wocommunity.org/job/WOLips47/lastSuccessfulBuild/artifact/temp/dist/content.xml>.
> Unable to read repository at 
> https://jenkins.wocommunity.org/job/WOLips47/lastSuccessfulBuild/artifact/temp/dist/content.xml
>  
> <https://jenkins.wocommunity.org/job/WOLips47/lastSuccessfulBuild/artifact/temp/dist/content.xml>.
> sun.security.validator.ValidatorException: PKIX path building failed: 
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find 
> valid certification path to requested target
> 
> Checking the ssl config with 
> https://www.ssllabs.com/ssltest/analyze.html?d=jenkins.wocommunity.org 
> <https://www.ssllabs.com/ssltest/analyze.html?d=jenkins.wocommunity.org> 
> reveals that the certificate chain is incomplete.
> 
> I do not have problems with browser that either already have it or download 
> it silently but Java does not seem to like this.
> 
> With apache, the chain is added with a config like this:    
> SSLCertificateChainFile "/[...]/letsencrypt/live/[...]/chain.pem"
> 
> Samuel
> 
> 
> 
>> Le 21 févr. 2018 à 11:34, Maik Musall <m...@selbstdenker.ag 
>> <mailto:m...@selbstdenker.ag>> a écrit :
>> 
>> Done.
>> 
>> Sorry for the delay, it took a while to figure out how to automate this with 
>> our load balancers in front of everything terminating the TLS connections ;-)
>> 
>> Maik
>> 
>> 
>>> Am 21.02.2018 um 08:23 schrieb Maik Musall <m...@selbstdenker.ag 
>>> <mailto:m...@selbstdenker.ag>>:
>>> 
>>> Hi all,
>>> 
>>> I just noticed that the TLS certificate on wocommunity.org 
>>> <http://wocommunity.org/> has expired, and I thought I already had set up 
>>> letsencrypt so I ignored the warning emails from Comodo. Turns out I had 
>>> not. So hang on, I will fix this today.
>>> 
>>> Maik
>>> 
>>> _______________________________________________
>>> Do not post admin requests to the list. They will be ignored.
>>> Webobjects-dev mailing list      (Webobjects-dev@lists.apple.com 
>>> <mailto:Webobjects-dev@lists.apple.com>)
>>> Help/Unsubscribe/Update your Subscription:
>>> https://lists.apple.com/mailman/options/webobjects-dev/maik%40selbstdenker.ag
>>>  
>>> <https://lists.apple.com/mailman/options/webobjects-dev/maik%40selbstdenker.ag>
>>> 
>>> This email sent to m...@selbstdenker.ag <mailto:m...@selbstdenker.ag>
>> 
>> _______________________________________________
>> Do not post admin requests to the list. They will be ignored.
>> Webobjects-dev mailing list      (Webobjects-dev@lists.apple.com 
>> <mailto:Webobjects-dev@lists.apple.com>)
>> Help/Unsubscribe/Update your Subscription:
>> https://lists.apple.com/mailman/options/webobjects-dev/samuel%40samkar.com 
>> <https://lists.apple.com/mailman/options/webobjects-dev/samuel%40samkar.com>
>> 
>> This email sent to sam...@samkar.com
> 

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list      (Webobjects-dev@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/webobjects-dev/archive%40mail-archive.com

This email sent to arch...@mail-archive.com

Reply via email to