{"action":"closed","issue":{"url":"https://api.github.com/repos/18F/api.data.gov/issues/324","repository_url":"https://api.github.com/repos/18F/api.data.gov","labels_url":"https://api.github.com/repos/18F/api.data.gov/issues/324/labels{/name}","comments_url":"https://api.github.com/repos/18F/api.data.gov/issues/324/comments","events_url":"https://api.github.com/repos/18F/api.data.gov/issues/324/events","html_url":"https://github.com/18F/api.data.gov/issues/324","id":144441164,"number":324,"title":"Get new SSL certificate for api.data.gov / implement non-SNI automatic SSL handling","user":{"login":"GUI","id":12112,"avatar_url":"https://avatars.githubusercontent.com/u/12112?v=3","gravatar_id":"","url":"https://api.github.com/users/GUI","html_url":"https://github.com/GUI","followers_url":"https://api.github.com/users/GUI/followers","following_url":"https://api.github.com/users/GUI/following{/other_user}","gists_url":"https://api.github.com/users/GUI/gists{/gist_id}","starred_url":"https://api.github.com/users/GUI/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GUI/subscriptions","organizations_url":"https://api.github.com/users/GUI/orgs","repos_url":"https://api.github.com/users/GUI/repos","events_url":"https://api.github.com/users/GUI/events{/privacy}","received_events_url":"https://api.github.com/users/GUI/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-30T02:18:15Z","updated_at":"2016-03-30T05:34:22Z","closed_at":"2016-03-30T05:34:22Z","body":"The SSL certificate for api.data.gov expires April 1.\r\n\r\nWe want to switch it to use our new automated SSL setup using Let's Encrypt (see https://github.com/18F/api.data.gov/issues/269#issuecomment-186026166). However, the current implementation of our automatic SSL handling requires SNI support from clients. We're setting up all new agencies subdomains to require SNI, and we haven't seen any issues so far, but that's been a much smaller audience than switching over an existing domain like api.data.gov. Based on our analytics, I think api.data.gov may also have quite a bit of non-SNI traffic (various Java 6 and Python < 2.7.9 user agents), so we don't want to rollout any changes that would break non-SNI traffic without much more notification.\r\n\r\nWhat we'd like to do is update our automatic SSL proxy layer to be able to handle non-SNI clients. We'll then roll this out to api.data.gov as part of getting a new certificate before April 1. Once we have this capability to support non-SNI clients for specific domains, we can then offer it to other existing agencies who might not still need non-SNI support. There are several existing agencies with certs expiring this spring, so there might be a number of opportunities to use this."}}