search

freeCodeCamp / open-api

freeCodeCamp's open-api Intiative
BSD 3-Clause "New" or "Revised" License
88 stars 28 forks source link

CNAMEs and HTTPS certificates #167

Open ojongerius opened 6 years ago

ojongerius commented 6 years ago

api-stage works, but https fails: https://api-stage.freecodecamp.org/stage/api


api-stage.freecodecamp.org uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH```
raisedadead commented 6 years ago

I think there a couple issues here.

  1. We need to toggle the traffic to directly reach the endpoint without passing though it. This is because the SSL Cert is shared among our other entities.

    The fix in that case is simply, toggle the orange cloud thing besides the entry for the CNAME

  2. Double check CNAME flattening, but I think that needs to be investigated after 1. is taken care off.

Bouncey commented 6 years ago

cname

ojongerius commented 6 years ago

Same deal.

I have good experience with https://aws.amazon.com/certificate-manager . I see they support importing third-party-certificates. We can either import certificates in to certificate manager or create a new one (it's free).

ojongerius commented 6 years ago

While we are at it, can we update the CNAME? I've deployed stage to the freeCodeCamp account and the URL is now: https://hxtsoafqna.execute-api.us-east-1.amazonaws.com

raisedadead commented 6 years ago

@ojongerius that is the intent. @Bouncey has confirmed that the traffic is not going through CloudFlare, it would need a SSL cert.

One can be created using any method that is suitable. Will you be able to do that using the certificate-manager? Would it need domain verification records (TXT), etc.?

If that is the case, we should just do this over a call with @freeCodeCamp/open-api It will just be faster that way.

Bouncey commented 6 years ago

CNAME updated.

If we send the traffic through cloudflare would it not pick up our https cert? Do we not want this?

raisedadead commented 6 years ago

If we send the traffic through cloudflare would it not pick up our https cert? Do we not want this?

If we send traffic trough CF, then the cert used would be of the ones provided by CF. But since the actual API end point is having a default cert of its own (even when we do not give it one), there is a mismatch.

In that case, it should just directly hit the API as it is bypassing CF.

But this also fails, because we are using a CNAME for the API, which CF flattens out.

So, we need to install a SSL cert at the endpoint. This SSL cert should cover the intended final domain api-stage.freecodecamp.org & api.freecodecamp.org for that matter.

This way after we bypass the CF, and hit the endpoint with our CNAME (flattened) domain, it resolves correctly, because the client sees that the domain is matching the cert (installed at the endpoint)

Hope this clarifies?