www.fmi-standard.org uses an invalid security certificate. about fmi-standard.org

[thorade]

https://blog.github.com/2018-05-01-github-pages-custom-domains-https/

[sjoelund]

Yes, we don't serve https since the move to GitHub web server since it doesn't support it. ⁣Sent from BlueMail ​

…

On 22 May 2017, 16:34, at 16:34, Johan Rhodin ***@***.***> wrote: The certificate is only valid for the following names: *.github.com, github.com, *.github.io, github.io Error code: SSL_ERROR_BAD_CERT_DOMAIN -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #15

[tbeu]

@casella There is now this issue on GitHub.

[johanrhodin]

OK, if that is the case this can be closed "as-designed" I guess.
(We should revisit when GitHub pages supports SSL for custom domains)

[thorade]

Also discussed here:
isaacs/github#156

[thorade]

Possibly this does now work (or soon).
Please check whether https can be enabled here:
https://github.com/modelica/fmi-standard.org/settings

According to Google, fmi-standard.org already has already received certificates from Let's encrypt:
https://transparencyreport.google.com/https/certificates
https://transparencyreport.google.com/https/certificates?cert_search_auth=&cert_search_cert=&cert_search=include_expired:true;include_subdomains:true;domain:fmi-standard.org&lu=cert_search

[sjoelund]

The modelica.org server at TUHH has (had) fmi-standard.org certificates. GitHub cannot use them and does not have any way of enabling https for custom domains. I have offered to enable transparent reverse proxy to serve the site, or to allow the CI system to upload the generated files to that server instead of github, but it seems people do not want this and prefer to have existing https links broken.

So fmi-standard.org (the current build system) cannot serve https.

sandbox.fmi-standard.org is the old build system.

preview.fmi-standard.org is the active certificate in there; that site is served by netlify, not github. @mtiller can expand on that; as far as I know it will be the next system used.

[thorade]

github is working on https for custom domains and is starting to roll it out, according to the linked discussion, but no official announcement so far.

[sjoelund]

OK, I'll need to look for that. newsletter.modelica.org was able to enable it, but it's not an apex domain. Perhaps www.fmi-standard.org would work?
Edit: Seems not; or it needs to stay for www.fmi-standard.org for a day or something, but that's not good...

[xogeny]

I don't know if anybody cares, but I'm using netlify to host https://preview.fmi-standard.org and the HTTPS support there is effortless. Assuming we accept the new FMI cross check process, then I would assume we'll publish that content to www.fmi-standard.org and fmi-standard.org. Netlify not only generates the SSL certificates for us automatically, they support multiple custom domains. I tried to add the top-level domain fmi-standard.org to see if it presented any problems. It accepted it, but gave me the following comment:

There are two options for pointing a root domain to Netlify.

Recommended: point ANAME or ALIAS record to angry-euclid-d015f6.netlify.com
Use a DNS provider that supports ANAME or ALIAS records, and alias fmi-standard.org to
angry-euclid-d015f6.netlify.com.

We recommend using NS1 or Netlify’s built-in DNS service for this.

fmi-standard.org ALIAS angry-euclid-d015f6.netlify.com.
Alternative: point A record to 104.198.14.52
Create an A record for fmi-standard.org pointing to our load balancer’s IP address 104.198.14.52.

fmi-standard.org A 104.198.14.52
If you’ve already done this, allow up to 24 hours for the changes to propagate, or check our
documentation for more information.

Hover doesn't seem to support ANAME or ALIAS records, but it can certainly handle A records. So this problem could fix itself fairly soon...

[sjoelund]

An alternative would be to redirect from fmi-standard.org to www.fmi-standard.org

[xogeny]

Yes, but these days, people expect https://fmi-standard.org to work. Seems like most sites now skip the www. (and probably redirect www to the TLD).

[sjoelund]

Indeed, it would be a little bit weird to redirect from fmi-standard.org to www.fmi-standard.org, but it's not like https://fmi-standard.org would not work; it's just that one of our webservers would redirect it to www. An A-record would also work but with calling the load-balancer instead of letting the DNS do the load-balancing.

[xogeny]

@thorade I think this is a moot point now. Our current process has us generating the site. This is because we not only need to run Jekyll, we need to run some scripts to pull in and validate vendor data in addition to simply generating the web site HTML.

However, this is good news for the SSP group and potentially for modelica.org if we every migrate that to using GitHub pages (not sure if that is the direction we will take, but it is good to know that SSL support won't be a problem if we do).

[sjoelund]

The certificate seems to have been issued May 2, but it took a while longer before the Github UI allowed clicking the box; it worked today and fmi-standard.org has https support again.

[beutlich]

Thanks. I updated the link in the GitHub description accordingly.