SSL

[bjacobel]

• Get a cert for: (blocker: Transfer domain ownership #21)
  • bowdoinorient.com
  • assets.bowdoinorient.com
  • tasks.bowdoinorient.com
  • live.bowdoinorient.com
• Deploy cert onto server
• Add to HSTS preload list
• Do some browser testing

[bjacobel]

I'd like to be able to have both assets.bowdoinorient.com (or maybe static. or cdn.) and beta.bowdoinorient.com under the same SSL certificate as bowdoinorient.com. Potentially even admin.bowdoinorient.com. The only way that will work is if we get a wildcard cert, which the only place I think you can get one for free at is GlobalSign's "free certs for open source".

One of their requirements is that the site "not be used for commercial purposes" so I don't know if we run afoul of that now or in the future.

Another is that the project be officially licensed so that issue (can't link because I'm on mobile now) is a blocker for this one now.

Anyway I'm going to apply for one and we'll see what they say.

[bjacobel]

GlobalSign says no:

Hello Brian,

This is Greg with the GlobalSign support team. Offhand it sounds like your project will meet the requirements for a free SSL cert once the site launches. Unfortunately the site needs to be live so we can review it to make sure it's non-commercial and its purpose is to promote the project itself. I'd encourage you to re-apply when the site goes live for review, but without a live page we are unable to issue a free cert for this.

If you have any questions or would like anything clarified, feel free to contact me.

Kind regards,

Gregory Tomko
GlobalSign Support Team

[bjacobel]

Let'sEncrypt looks like a good solution for this. It's "Coming mid-2015", so I'm going to move this into the backlog until then.

Let's Encrypt will not support wildcard certs so I'm also adding a task to this to generate certs for each subdomain.