Received: from mail-lf1-f51.google.com (mail-lf1-f51.google.com [209.85.167.51]) by nld3-dev1.alpinelinux.org (Postfix) with ESMTPS id B05567818A8 for <~alpine/users@lists.alpinelinux.org>; Mon, 25 Nov 2019 18:33:27 +0000 (UTC) Received: by mail-lf1-f51.google.com with SMTP id v201so10785008lfa.11 for <~alpine/users@lists.alpinelinux.org>; Mon, 25 Nov 2019 10:33:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=waveapps-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=wkOfFxetVQI2XiGsWD2kzrJS7RmvOSTh/N4ineF/tbA=; b=SkKL0eirRhNAWwsVq1eudgtpinBFn7RVdFcUrfM6dzMM9EDVaKLg2Xx/4XGL6LC9uj wNlsZ6MpjwVMKfeK73/HV/RCFnetQFB7mUwdfLsaMmjntn7m9jLwQVM6bAxgtOjWmOxl GPva0NcAsUt1Hpx5uGguihBEpjpydm50AbKBI3M1GFy5eYtNjhMIRYruopIM+TVmmv3m pUOZehLCjBW+CnXFMMOCiK+VTCVREcZ7h0Xh7MVdiFmmgSeNi3v0+eSHe4i8SD4EXlyL s/eTo3WT9YWddkIaliJ+wHr7egQJfccI1bGgWQBtPy1Gbes3n8Y9xXMmArCGLM5NM4Pu boBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=wkOfFxetVQI2XiGsWD2kzrJS7RmvOSTh/N4ineF/tbA=; b=SrGtWOgr3N+Kj1XMcjDzxMia3INJBh45AcqqMzKApqZl3Q9EBELE1C3lAJ2znGAcxb FGgDIkobhBGwmjsNcjS3eo+TxFfnB/ZiDAdE8RhzGkbeVPvsgyUjvIJOcP/puWGCEEcN agwXYxHKuUxCfCPEvgKYfXtQdykMtWzLvMEsF3O6gDHJaVldwaS0vS0A5dgH6GAfNc9l eN9LVtNXhVm7CUU6lgVC2hD0uiXumq2sBBVLe/RP9MLQDsMeYfE1pUqMLQ0C3IQLQdat zyon/vcvMCe8CcsQAB9PgZmIuwPpywK130dPIGOzKyHqz8ktrAEtYu5OOFSTkmEX6Li8 bMSg== X-Gm-Message-State: APjAAAXoLiHYkM5LM0MOBSP4X4xgcw4CdnXp36WsORJdblEwnXlYVHF6 GUAZpbrPb1LNLS/DJJVLyw/AmCbKBaja5odzXOmyQWRaGw/14QDQ X-Google-Smtp-Source: APXvYqzaPsdzllJwSKztdLKneQz/SW7FJSb9wwtZVfBsDCwoMjaVwKW/bCfiKGHXuQ1a2ozKM+g04yPFKpqhyPf6Y4Q= X-Received: by 2002:a19:751a:: with SMTP id y26mr22460735lfe.78.1574706805997; Mon, 25 Nov 2019 10:33:25 -0800 (PST) MIME-Version: 1.0 From: Michael Warkentin Date: Mon, 25 Nov 2019 13:33:15 -0500 Message-ID: Subject: alpine.gliderlabs.com redirect to HTTPS w/ invalid certificate To: ~alpine/users@lists.alpinelinux.org Content-Type: multipart/alternative; boundary="000000000000cc208a05982fff31" --000000000000cc208a05982fff31 Content-Type: text/plain; charset="UTF-8" Our apk configuration points to http://alpine.gliderlabs.com # cat /etc/apk/repositories http://alpine.gliderlabs.com/alpine/v3.9/main http://alpine.gliderlabs.com/alpine/v3.9/community This morning we noticed docker build failing with certificate errors: SSL certificate subject doesn't match host alpine.gliderlabs.com ERROR: http://alpine.gliderlabs.com/alpine/v3.10/main: Permission denied In Firefox if I visit the repository URL, I get the following warning: Firefox does not trust this site because it uses a certificate that is not valid for alpine.gliderlabs.com. The certificate is only valid for the following names: default.ssl.fastly.net, fastly.com, *.a.ssl.fastly.net, *. hosts.fastly.net, *.global.ssl.fastly.net, *.fastly.com, a.ssl.fastly.net, purge.fastly.net, mirrors.fastly.net, control.fastly.net, tools.fastly.net Error code: SSL_ERROR_BAD_CERT_DOMAIN I'm seeing a 301 permanent redirect (as well as HSTS headers) in curl when I hit the repository: mwarkentin@Michaels-iMac ~ % curl -I http://alpine.gliderlabs.com/alpine/v3.9/community HTTP/1.1 301 Moved Permanently Server: nginx Content-Type: text/html Location: https://alpine.gliderlabs.com/alpine/v3.9/community Strict-Transport-Security: max-age=31536000 X-Frame-Options: DENY X-Content-Type-Options: nosniff Via: 1.1 varnish Content-Length: 178 Accept-Ranges: bytes Date: Mon, 25 Nov 2019 16:53:57 GMT Via: 1.1 varnish Age: 7 Connection: keep-alive X-Served-By: cache-jfk8126-JFK, cache-mdw17368-MDW X-Cache: MISS, HIT X-Cache-Hits: 0, 1 X-Timer: S1574700837.202582,VS0,VE0 I'm doing some work to switch over to https://alpine.global.ssl.fastly.net instead, but I haven't seen any discussion on these issues anywhere else so wondering if we've done something strange in our setup. Thanks! *MICHAEL **WARKENTIN* | Operations Engineer Join our community on Facebook , LinkedIn , or Twitter This message and any attachments are intended only for the use of the addressee and should be considered confidential. If you are not an intended recipient, you may not review, copy or distribute this message. If you have received this communication in error or would like to stop receiving these emails, please notify the sender by replying to this email. Wave is located at 235 Carlaw Ave., Ste. 501, Toronto ON, M4M 2S1. --000000000000cc208a05982fff31 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Our apk configuration points to http://alpine.gliderlabs.com
This morning we noti= ced docker build failing with certificate errors:

= SSL certificate subject doesn't match host alpine.gliderlabs.com
ERROR: http://alpine.gliderlabs.com/alpine/v3.10/= main: Permission denied

In Firefox if I visit = the repository URL, I get the following warning:

F= irefox does not trust this site because it uses a certificate that is not v= alid for alpine.gliderlabs.com= . The certificate is only valid for the following names: default.ssl.fastly.net, fastly.com, *.a.ssl.fastly.n= et, *.hosts.fastly.net, *.global.ssl.fastly.net, *.fastly.com, a.s= sl.fastly.net, purge.fastly.net= , mirrors.fastly.net, control.fastly.net, tools.fastly.net
=C2=A0
Error code: SSL_ERROR_BAD_CER= T_DOMAIN

I'm seeing a 301 permanent redirect (= as well as HSTS headers) in curl when I hit the repository:

<= /div>
mwarkentin@Michaels-iMac ~ % curl -I http://alpine.gliderlabs.com/alpine/v3.9= /community
HTTP/1.1 301 Moved Permanently
Server: nginx
Conten= t-Type: text/html
Location: https://alpine.gliderlabs.com/alpine/v3.9/community=
Strict-Transport-Security: max-age=3D31536000
X-Frame-Options: DENY<= br>X-Content-Type-Options: nosniff
Via: 1.1 varnish
Content-Length: 1= 78
Accept-Ranges: bytes
Date: Mon, 25 Nov 2019 16:53:57 GMT
Via: 1= .1 varnish
Age: 7
Connection: keep-alive
X-Served-By: cache-jfk812= 6-JFK, cache-mdw17368-MDW
X-Cache: MISS, HIT
X-Cache-Hits: 0, 1
X-= Timer: S1574700837.202582,VS0,VE0

I'm doing so= me work to switch over to = https://alpine.global.ssl.fastly.net instead, but I haven't seen an= y discussion on these issues anywhere else so wondering if we've done s= omething strange in our setup.

Thanks!

--000000000000cc208a05982fff31--