Website: SSL cert error on www.kubernetes.io

[lheckemann]

This is a...

• [ ] Feature Request
• [x] Bug Report

Problem:
https://www.kubernetes.io will not load because the certificate is only valid for a long list of domains (including kubernetes.io without the www). This is a problem because some search engines (e.g. duckduckgo) point to www.kubernetes.io.

Proposed Solution:
Add www.kubernetes.io to the certificate's alt-names.

Page to Update:
https://www.kubernetes.io/

[ahmetb]

This seems to be fixed. We can close @chenopis.

[chenopis]

@ahmetalpbalkan Thanks for letting me know.

[lheckemann]

Issue still exists as far as I can tell.

[chenopis]

@ahmetalpbalkan We need to take a closer look at this. Thanks for keeping on this @lheckemann

[meacer]

This might appear fixed if you are testing with Chrome, because Chrome redirects SSL errors caused by name mismatches to the actual site: https://crbug.com/507454

In this case, Chrome checks https://kubernetes.io (because it's in the cert served by https://www.kubernetes.io), determines it's available, automatically redirects to it and prints a console message.

If you launch Chrome with --force-fieldtrials=SSLCommonNameMismatchHandling/Disabled/ flag, you'll see that the problem still exists (note that the flag was changed to --disable-feature=SSLCommonNameMismatchHandling on beta, dev and canary channels).

[RByers]

/cc @patrickkettner on the Edge team who noticed links to https://www.kubernetes.io are broken in Edge but not Chrome.

[steveperry-53]

@lheckemann @ahmetb @patrickkettner @chenopis I can't reproduce this. For me, https://www.kubernetes.io works on Chrome, Edge, and Safari. Could you check and see whether this is still a problem? Thanks.

```
curl -v https://www.kubernetes.io

• Rebuilt URL to: https://www.kubernetes.io/
• Trying 45.54.44.100...
• Connected to www.kubernetes.io (45.54.44.100) port 443 (#0)
• found 148 certificates in /etc/ssl/certs/ca-certificates.crt
• found 597 certificates in /etc/ssl/certs
• ALPN, offering http/1.1
• SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
• server certificate verification OK
• server certificate status verification SKIPPED
• common name: kubernetes.io (matched)
• server certificate expiration date OK
• server certificate activation date OK
• certificate public key: RSA
• certificate version: #3
• subject: CN=kubernetes.io
• start date: Tue, 25 Jul 2017 23:11:00 GMT
• expire date: Mon, 23 Oct 2017 23:11:00 GMT
• issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
• compression: NULL
• ALPN, server accepted to use http/1.1

GET / HTTP/1.1
Host: www.kubernetes.io
User-Agent: curl/7.47.0
Accept: /

< HTTP/1.1 301 Moved Permanently
< Cache-Control: public, max-age=0, must-revalidate
< Content-Length: 38
< Content-Type: text/plain
< Date: Thu, 05 Oct 2017 06:31:20 GMT
< Location: https://kubernetes.io/
< Strict-Transport-Security: max-age=31536000
< Age: 12
< Connection: keep-alive
< Server: Netlify
<
Redirecting to https://kubernetes.io/

• Connection #0 to host www.kubernetes.io left intact
  ```

[ahmetb]

I think this is now fixed, possibly after Netlify migration.

[steveperry-53]

Thanks @ahmetb. Are the rest of you (@lheckemann @patrickkettner @chenopis ) OK with closing this?

[chenopis]

I tried Chrome with the --force-fieldtrials=SSLCommonNameMismatchHandling/Disabled/ flag and didn't see any problems w/ https://www.kubernetes.io -- it redirects properly to https://kubernetes.io. Consequently, I'm fine w/ closing this issue.

[lheckemann]

Can confirm, seems to work now.

[KasunKulathunga]

Still it seems not workng in the firefox
kubernetes.io uses an invalid security certificate. The certificate will not be valid until December 27, 2018, 3:38:15 AM GMT+5:30. The current time is December 24, 2018, 11:19 AM. Error code: MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE

[lheckemann]

@KasunKulathunga this seems like a different problem which is caused by your system clock being wrong.

[KasunKulathunga]

Sorry.Yeah.Thanks.That was different case and sorted out.