Closed mlandauer closed 2 years ago
I think we can implement this without any changes to the user experience. It can happen completely automatically behind the scenes. If a user puts in a custom domain for link tracking as well as the current thing where it is checked that the custom domain points at the cuttlefish domain, we get an ssl certificate behind the scenes. When that certificate is ready and working we can then automatically use https for the open image and the link tracking links. It might be nice to show the user whether links are going to use http or https just for their own reassurance.
https://github.com/unixcharles/acme-client looks like a nice library for doing the job. I'm thinking we use a single account for all of cuttlefish. When a custom domain has been setup we start a background job for generating the SSL certificate. We'll then need to write the ssl certificate to disk for nginx and tell nginx to reload. Fun and games this will be. We'll also need a rake task that runs once per day that checks if any certificates are going to expire and regenerate them if they are.
This is now largely (maybe 3/4) implemented. What's working now:
What's left to do:
Some potential further work:
The three things left do (from above) are now done:
I'm not going to worry about the concurrency issue for the time being. Let's just call this done and move on
Currently we use plain http for links that do link tracking. This is not ideal as the world is very quickly moving to being https everywhere.
We should automatically use let's encrypt to get SSL certificates for custom domains and use those with link tracking. That means all links will be SSL encrypted which is obviously better all round and means that we can set HSTS for root domains for applications that use custom subdomains.
See https://github.com/openaustralia/publicwhip/issues/1274 for example problem with theyvoteforyou.org.au. We also know that there are similar problems with PA.
A workaround would be to disable link tracking for the time being which I have no trouble with.