rt.cpan.org uses an invalid security certificate.

[Marc Girod]

Hi,

I intended to submit a bug for the Tk module, via the CPAN web
interface, using firefox.
I tried thus to login, but got an error such as:

Secure Connection Failed
rt.cpan.org uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown.
(Error code: sec_error_unknown_issuer)
* This could be a problem with the server's configuration, or it
could be someone trying to impersonate the server.
* If you have connected to this server successfully in the past,
the error may be temporary, and you can try again later.
Or you can add an exception…

Does anybody else meet this problem?
Thanks,

Marc

[Marc Girod]

Thanks Jon,

If I recall correctly, the CPAN RT system uses a self-signed
certificate.

This is recent, isn't it?
I must have been able to sign in already in the past...
Maybe not more recently than a bit less than one year ago.

Firefox has a procedure to make an exception,
so I can get through.

Thanks a lot.
Marc

P.S. Shouldn't this be a FAQ?
Or would that be a security hole?

[Mark J. Reed]

Post by Marc Girod
This is recent, isn't it?
I must have been able to sign in already in the past...
Maybe not more recently than a bit less than one year ago.

The change is Firefox 3, which is much pickier about such things than Firefox 2.

Post by Marc Girod
P.S. Shouldn't this be a FAQ?

Probably.

Post by Marc Girod
Or would that be a security hole?

The fact that the cert is self-signed is a security hole, since it
potentially allows traffic to be intercepted by a third party; but
writing up a FAQ entry on it wouldn't make the hole any bigger.

So what would it take to get a real cert going? It looks like a
minimally-verified (proven ownership of the domain name) SSL cert is
about $50/year. I know this came up in another thread recently, but
I didn't see an ansewr: who foots the bill for CPAN's domain
registration?

[Jonathan Yu]

Post by Mark J. Reed

Post by Marc Girod
This is recent, isn't it?
I must have been able to sign in already in the past...
Maybe not more recently than a bit less than one year ago.

The change is Firefox 3, which is much pickier about such things than Firefox 2.

Indeed. You can still add it to the certificate store in Firefox 3,
but it's a few more clicks and harder to dismiss. The intent of this
is to make people actually think about that stuff before they just
accept it, and thereby hopefully prevent Man-in-the-Middle type
attacks, especially for high-security sites like banks.

Post by Mark J. Reed

Post by Marc Girod
P.S. Shouldn't this be a FAQ?

Probably.

Post by Marc Girod
Or would that be a security hole?

The fact that the cert is self-signed is a security hole, since it
potentially allows traffic to be intercepted by a third party; but
writing up a FAQ entry on it wouldn't make the hole any bigger.
So what would it take to get a real cert going? It looks like a
minimally-verified (proven ownership of the domain name) SSL cert is
about $50/year.

As I mentioned, CAcert certificates are free and anyone with a
Certificate of Incorporation for the organization (CPAN) can get an
Organizational Certificate, among other great things. But the problem
is that you have to manually add the CAcert Root certificates. This is
trivial and supported in many browsers, but it would require an FAQ
entry to teach people how to add it.

They are working toward getting the root certificates (at least the
Class 3, higher-trusted type) into Firefox and other browsers. Last I
heard, the Firefox team is still reviewing it. But it does come
default in the "ca-certificates" package on Debian now.

In short - I think using a CAcert certificate would be significantly
better than the current system, and I would encourage them to do so.

Post by Mark J. Reed
I know this came up in another thread recently, but
I didn't see an ansewr: who foots the bill for CPAN's domain
registration?

The person that runs CPAN - though I once sent him an email and never
received a response:

Yours Eclectically, The Self-Appointed Master Librarian (OOK!) of the CPAN
Jarkko Hietaniemi ***@perl.org [Disclaimer]

Also it was mentioned, also from the CPAN home page, the master site
is hosted by FUNET:
http://www.csc.fi/english/institutions/funet_en/index_html

But the certificate itself is signed by Best Practical Solutions, so I
imagine they are the ones running the Request Tracker (being the ones
that wrote the software and provide support for it to enterprise
users). Their web site is http://bestpractical.com/ - if someone would
take the initiative to contact them about it, they may be able to find
a solution.

Post by Mark J. Reed
--

[Earl Ruby]

But unfortunately CAcert's root
certificates do not, to my knowledge, come bundled with a default
installation of Firefox and need to be installed manually.

CAcert is currently undergoing Mozilla's audit policy
(http://www.mozilla.org/projects/security/certs/policy/) in order to get
their certificate included in Firefox and Thunderbird. Their root cert
is still not included in OS/X or Safari and Windows/IE requires a $75K
audit + $10k/year fees for a Webtrust audit.

See http://wiki.cacert.org/wiki/InclusionStatus for more info.

PAUSE uses CAcert, and requests that people install CAcert's root cert
in their browser to use PAUSE:

http://www.cpan.org/modules/04pause.html#ssl

Seems like a decent approach.

[Jesse Vincent]

It actually use a self-signed certificate. Firefox 3 started being
overzealous about such things.

Post by Marc Girod
Hi,
I intended to submit a bug for the Tk module, via the CPAN web
interface, using firefox.
Secure Connection Failed
rt.cpan.org uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is unknown.
(Error code: sec_error_unknown_issuer)
* This could be a problem with the server's configuration, or it
could be someone trying to impersonate the server.
* If you have connected to this server successfully in the past,
the error may be temporary, and you can try again later.
Or you can add an exception…
Does anybody else meet this problem?
Thanks,
Marc