HTTPS + Basic Auth access to the website

Hi Frank,

I have configured the website to support HTTPS + Basic Auth access.  If you 
go to <https://www.openspf.org/auth>, it will use Basic Auth instead of 
Digest Auth.

<https://www.openspf.org> uses an SSL certificate signed by our newly 
created "openspf.org" CA (see my following message to spf-council).

I am having trouble accessing <https://www.openspf.org> with Internet 
Explorer, however it works fine with Firefox and Opera.  Scott reported 
that it works with Konqueror, too.  I think the IE problem might have 
something to do with an incompatibility of the SSL certificate, however I 
totally lack the impetus to debug it.  You're going to use some 
other "Mozilla 3.0" browser anyway.  Let me know if you have any problems.

Your password is the same as the one I had originally sent you for the 
Subversion repository on 2006-09-21 (ask if you don't have it anymore).  
You can change it by clicking on the "Change Password" link in the toolbar 
at the top of the website.

--

-- 

Note to self:  This is a gross hack in the webserver configuration, 
essentially duplicating both /etc/thingy/instances/spf/httpd.conf and
/etc/apache2/sites-available/spf (thus causing redundancy).  The hack 
should eventually be undone, as soon as Frank gets a new web browser that 
supports HTTP Digest Auth (hint, hint).

Re: HTTPS + Basic Auth access to the website

I don't think all of this belongs on spf-webmasters, so I'm replying only 
to the most relevant parts here (+ on spf-council), and to the rest 
privately.

Frank Ellermann wrote:
> Julian Mehnle wrote on spf.council:
> > I am having trouble accessing <https://www.openspf.org> with Internet
> > Explorer, however it works fine with Firefox and Opera.
>
> AFAIK IE doesn't like self-signed certificates, but I can't test it
> at the moment.  Depending on the configuration it could also check
> revoked certificates, but I forgot how that works, is it some "well-
> known location" magic ?

The certificate isn't self-signed.  It is signed by the new "openspf.org" 
CA (which is of course unknown to IE, but that shouldn't stop it).

> [...]  I could even install openspf as CA if you publish the root
> certificate.

I did.  Look for my message on spf-council about the new CA.

> When I tried it I found that "mozilla 3" won't like more than 1024 at
> some point of the openssl procedure, but obviously you avoided that trap.

Lucky you!  I've recently heard recommendations to start using 2048+ bits 
certificates, but I decided to hold off on that one more time...  Next 
year things are probably going to look different.

RE: Re: HTTPS + Basic Auth access to the website

> I am having trouble accessing <https://www.openspf.org> with Internet
> Explorer, however it works fine with Firefox and Opera.

	It works fine for me with IE 7.  I get the certificate warning
and then the red address bar, of course.  IE 7 shows the warning as a
"web page" within the browser instead of a popup dialog box.

 - Steve Yates
 - ITS, Inc.
 - If brute force isn't working, then you're not using enough.

~ Taglines by Taglinator - www.srtware.com ~