Missing Subject Alternative Names in ftp mirrors site certificate

Поиск
Список
Период
Сортировка
От Ben Buley
Тема Missing Subject Alternative Names in ftp mirrors site certificate
Дата
Msg-id CAHV-pqwkxqUBaXac-9on7r9LZozKXaOF-3eyn3mfDXnFwFYEdQ@mail.gmail.com
обсуждение исходный текст
Ответы Re: Missing Subject Alternative Names in ftp mirrors site certificate  (Magnus Hagander <magnus@hagander.net>)
Список pgsql-www
All, not sure if this is the correct mailing list, so please direct me if necessary.

The download.postgresql.org has an incomplete TLS certificate that is missing some Subject Alt Names currently included in the DNS for ftp.mirrors.postgresql.org.  
The round-robin DNS occasionally hits a valid name that is listed in the certificate, but many of them fail.  Certificate shows SANs for:
   SN = ftp.postgresql.org
   SAN DNS Name = apt.postgresql.org
   SAN DNS Name = download.postgresql.org
   SAN DNS Name = fendaus.postgresql.org
   SAN DNS Name = ftp.postgresql.org

The IPs listed for download.postgresql.org and ftp.postgresql.org show the following IPs (listing IPv4 only):
   Non-authoritative answer:
   ftp.postgresql.org      canonical name = ftp.mirrors.postgresql.org.
   Name:   ftp.mirrors.postgresql.org
   Address: 147.75.85.69
   Name:   ftp.mirrors.postgresql.org
   Address: 217.196.149.55
   Name:   ftp.mirrors.postgresql.org
   Address: 72.32.157.246
   Name:   ftp.mirrors.postgresql.org
   Address: 87.238.57.227

And the reverse DNS shows the following alternative names being used:
   55.48-63.149.196.217.in-addr.arpa       name = fabrina.postgresql.org.
   246.157.32.72.in-addr.arpa      name = faynos.postgresql.org.
   69.85.75.147.in-addr.arpa       name = fendaus.postgresql.org.
   227.226-238.57.238.87.in-addr.arpa      name = feris.postgresql.org.

I only see one server that matches (fendaus.postgresql.org) which aligns to me failure rate of TLS certificate errors (edited).  Additionally, ftp.mirrors.postgresql.org isn't listed in the SAN either and throws an certificate error.  

For background, I pulled a RHEL 7 repo RPM from here and that's where I first noticed the issues (by failed YUM/curl connections).
https://download.postgresql.org/pub/repos/yum/9.5/redhat/rhel-7-x86_64/pgdg-redhat-repo-latest.noarch.rpm 

Thanks,

Ben Buley
buleyb@gmail.com

В списке pgsql-www по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: Re: "502 Bad Gateway" on gitweb?
Следующее
От: Magnus Hagander
Дата:
Сообщение: Re: Missing Subject Alternative Names in ftp mirrors site certificate