[wp-trac] [WordPress Trac] #25252: Pin the WordPress.org SSL certificates

[WordPress Trac]

#25252: Pin the WordPress.org SSL certificates
----------------------------+--------------------
 Reporter:  rmccue          |       Owner:
     Type:  task (blessed)  |      Status:  new
 Priority:  normal          |   Milestone:  3.7
Component:  HTTP            |     Version:  trunk
 Severity:  normal          |  Resolution:
 Keywords:                  |
----------------------------+--------------------

Comment (by rmccue):

 Replying to [comment:3 nacin]:
 > Setting this to a task so it can ride. We need to make a determination
 here. Who do we need to involve to help inform a decision here?

 Whoever is in charge of dotorg's certificates should weigh in. I'm
 guessing that might be barry?

 Regarding dd32's comments above, the way Google (e.g.) does it is to have
 two main CAs that they trust, and pin both of them. That way you're locked
 into two CAs rather than one. Option 3 might be hard, depending on whether
 you can get certificates which will live for that long. GoDaddy's own CA
 certificate is a 30 year certificate, and the one they've used to sign
 *.wordpress.org is a 20 year certificate, so it seems reasonable to think
 we can get a 10 year certificate. (Given WP's age, I think 10 years is
 large enough, and we could probably go lower.)

 One other option we could consider is to have a special form of
 autoupdating just for the certificates. If WP can make a secure connect to
 dotorg, we could update the existing certificate list, *but* this brings
 with it further security concerns. I'd prefer to avoid this personally.

--
Ticket URL: <http://core.trac.wordpress.org/ticket/25252#comment:4>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software