add TLS support for publisher app

[GoogleCodeExporter]

1) need to add tls cert and tls key to the config, and support that follows

2) will probably run into the problem that we'll get an CAMLI_API_HOST address 
with an IP (instead of a host name), which will make getting the config.json 
fail, in the case where the SSL cert used for Camlistore does not contain any 
IP SAN

3) all the self-cert dance support? but I sortof agree that we should probably 
get rid of it, and just make it a requirement to have proper certs.

Original issue reported on code.google.com by mathieu....@gmail.com on 16 Jun 2014 at 2:40

[GoogleCodeExporter]

https://camlistore-review.googlesource.com/2976

Original comment by mathieu....@gmail.com on 16 Jun 2014 at 4:16

• Changed state: Started

[GoogleCodeExporter]

I consider 1) fixed with https://camlistore-review.googlesource.com/2976 but 
here are more explanation about 2):

if baseURL is not specified in the high-level config (for Camlistore itself, 
not the publish section), then in camlistored.go, we default to baseURL = 
ws.ListenURL(), which will be passed to InstallHandlers, which in turn will 
pass it to app.NewHandler, and we'll eventually end up with CAMLI_API_HOST and 
CAMLI_APP_BACKEND_URL having an IP address instead of a host name (becaus 
that's what ListenURL() gives us).

This is a problem with HTTPS, because when the app fetches its config.json from 
Camlistore, it will then use this IP based URL, which will result in an error, 
if (like me) your certificate does not have an IP SAN for this address.

However, correctly setting baseURL in the config does solve this problem as far 
as I can see, so the question is, do we consider that a bug that needs fixing?

If not, I think properly documenting that baseURL should be set (and why) when 
publishing should be enough.

Original comment by mathieu....@gmail.com on 16 Jun 2014 at 6:11

[GoogleCodeExporter]

I don't care about anything related to self-signed certs, or SSL at all for the 
publisher.

People wanting SSL can do it in their own server and make the non-HTTPS 
publisher app be the backend.

Original comment by bradfitz on 16 Jun 2014 at 7:28

[GoogleCodeExporter]

Just to be clear, the problem I'm talking about in 2) comes from Camlistore 
serving on HTTPS, regardless of whether the app is doing the same. And it has 
nothing to do with self-signed.

Original comment by mathieu....@gmail.com on 16 Jun 2014 at 7:34

[GoogleCodeExporter]

For 2) There should be support in camlistored for running a secondary HTTP 
listener on a different address, which then becomes the API host.  So 
camlistored will respond to both https://foo.com/ and http://10.1.2.3/

Original comment by bradfitz on 16 Jun 2014 at 7:57

[GoogleCodeExporter]

ah I see, nice. I'll look into it.

Original comment by mathieu....@gmail.com on 16 Jun 2014 at 8:01

[GoogleCodeExporter]

736648ce9cb3a82fbbb5fe76689014fd967bd133 fixes 1)

Original comment by mathieu....@gmail.com on 16 Jun 2014 at 8:10

[GoogleCodeExporter]

This issue has moved to https://camlistore.org/issue/458

Original comment by bradfitz on 14 Dec 2014 at 11:37

• Changed state: Moved
• Added labels: IssueMoved, Restrict-AddIssueComment-Commit