{"action":"created","issue":{"url":"https://api.github.com/repos/NRGI/resourcecontracts.org/issues/1092","repository_url":"https://api.github.com/repos/NRGI/resourcecontracts.org","labels_url":"https://api.github.com/repos/NRGI/resourcecontracts.org/issues/1092/labels{/name}","comments_url":"https://api.github.com/repos/NRGI/resourcecontracts.org/issues/1092/comments","events_url":"https://api.github.com/repos/NRGI/resourcecontracts.org/issues/1092/events","html_url":"https://github.com/NRGI/resourcecontracts.org/issues/1092","id":294442053,"number":1092,"title":"Renew SSL certificate for `*.resourcecontracts.org`","user":{"login":"iprunache","id":15313824,"avatar_url":"https://avatars2.githubusercontent.com/u/15313824?v=4","gravatar_id":"","url":"https://api.github.com/users/iprunache","html_url":"https://github.com/iprunache","followers_url":"https://api.github.com/users/iprunache/followers","following_url":"https://api.github.com/users/iprunache/following{/other_user}","gists_url":"https://api.github.com/users/iprunache/gists{/gist_id}","starred_url":"https://api.github.com/users/iprunache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iprunache/subscriptions","organizations_url":"https://api.github.com/users/iprunache/orgs","repos_url":"https://api.github.com/users/iprunache/repos","events_url":"https://api.github.com/users/iprunache/events{/privacy}","received_events_url":"https://api.github.com/users/iprunache/received_events","type":"User","site_admin":false},"labels":[{"id":821536504,"url":"https://api.github.com/repos/NRGI/resourcecontracts.org/labels/Vitamin","name":"Vitamin","color":"0dad01","default":false}],"state":"open","locked":false,"assignee":{"login":"adinuca","id":3942821,"avatar_url":"https://avatars1.githubusercontent.com/u/3942821?v=4","gravatar_id":"","url":"https://api.github.com/users/adinuca","html_url":"https://github.com/adinuca","followers_url":"https://api.github.com/users/adinuca/followers","following_url":"https://api.github.com/users/adinuca/following{/other_user}","gists_url":"https://api.github.com/users/adinuca/gists{/gist_id}","starred_url":"https://api.github.com/users/adinuca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adinuca/subscriptions","organizations_url":"https://api.github.com/users/adinuca/orgs","repos_url":"https://api.github.com/users/adinuca/repos","events_url":"https://api.github.com/users/adinuca/events{/privacy}","received_events_url":"https://api.github.com/users/adinuca/received_events","type":"User","site_admin":false},"assignees":[{"login":"adinuca","id":3942821,"avatar_url":"https://avatars1.githubusercontent.com/u/3942821?v=4","gravatar_id":"","url":"https://api.github.com/users/adinuca","html_url":"https://github.com/adinuca","followers_url":"https://api.github.com/users/adinuca/followers","following_url":"https://api.github.com/users/adinuca/following{/other_user}","gists_url":"https://api.github.com/users/adinuca/gists{/gist_id}","starred_url":"https://api.github.com/users/adinuca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adinuca/subscriptions","organizations_url":"https://api.github.com/users/adinuca/orgs","repos_url":"https://api.github.com/users/adinuca/repos","events_url":"https://api.github.com/users/adinuca/events{/privacy}","received_events_url":"https://api.github.com/users/adinuca/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2018-02-05T15:52:26Z","updated_at":"2018-02-08T11:07:23Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"## Why\r\nThe SSL certificate for `*.resourcecontracts.org` has expired and users receive a warning when accessing RC sites over HTTPS.\r\n\r\nMTurk users are not able to complete their tasks on RC because of the certificate warning.\r\n\r\n## What\r\n- [x] generate a new AWS SSL certificate for `*.resourcecontracts.org`\r\n   - [x] use DNS validation to validate the certificate\r\n- [x] set up all load balancers serving resource contracts sites to use the new certificate\r\n- [x] delete the expired SSL certificate\r\n- [ ] set up an alert if possible to notify us when the certificate expires and renewal validation fails\r\n\r\n## Notes\r\nThe certificate was configured for auto renewal but during renewal we need to validate the certificate by replying to an email that AWS sends to the AWS root email account and a series of web admin email addresses. We control none of those emails so we failed to see the notification of renewal.\r\n\r\nAWS ACM provides a second option for certificate validation that we should explore: DNS validation, since we control the DNS record in Route 53."},"comment":{"url":"https://api.github.com/repos/NRGI/resourcecontracts.org/issues/comments/364079016","html_url":"https://github.com/NRGI/resourcecontracts.org/issues/1092#issuecomment-364079016","issue_url":"https://api.github.com/repos/NRGI/resourcecontracts.org/issues/1092","id":364079016,"user":{"login":"iprunache","id":15313824,"avatar_url":"https://avatars2.githubusercontent.com/u/15313824?v=4","gravatar_id":"","url":"https://api.github.com/users/iprunache","html_url":"https://github.com/iprunache","followers_url":"https://api.github.com/users/iprunache/followers","following_url":"https://api.github.com/users/iprunache/following{/other_user}","gists_url":"https://api.github.com/users/iprunache/gists{/gist_id}","starred_url":"https://api.github.com/users/iprunache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iprunache/subscriptions","organizations_url":"https://api.github.com/users/iprunache/orgs","repos_url":"https://api.github.com/users/iprunache/repos","events_url":"https://api.github.com/users/iprunache/events{/privacy}","received_events_url":"https://api.github.com/users/iprunache/received_events","type":"User","site_admin":false},"created_at":"2018-02-08T11:07:23Z","updated_at":"2018-02-08T11:07:23Z","author_association":"CONTRIBUTOR","body":"@adinuca according to this we may risk automatic renewal to fail if we don't get `resourcecontracts.org` to work over https: https://docs.aws.amazon.com/acm/latest/userguide/how-domain-validation-works.html#how-automatic-domain-validation-works\r\n\r\nIf I understand correctly, to check that the old certificate is in use, ACM will do a request to resourcecontracts.org and compare the returned certificate."}}
{"actor":{"display_login":"iprunache"}}