Recently there is much talk on Planet Debian about LetsEncrypt certs. This is great, because using HTTPS everywhere improves security and gives the NSA some more work to decrypt the traffic.
However, when you enabled your blog with a LetsEncrypt cert, you might run into the same problem as I: your new article won’t show up on Planet Debian after changing your feed URI to HTTPS. The reason seems to be quite simple: planet-venus, which is the software behind Planet Debian seems to have problems with SNI enabled websites.
When following the steps outlined in the Debian Wiki, you can check this by yourself:
INFO:planet.runner:Fetching https://blog.windfluechter.net/taxonomy/term/2/feed via 5
ERROR:planet.runner:HttpLib2Error: Server presented certificate that does not match host blog.windfluechter.net: {‘subjectAltName’: ((‘DNS’, ‘abi94oesede.de’), (‘DNS’, ‘www.abi94oesede.de’)), ‘notBefore’: u’Jan 26 18:05:00 2016 GMT’, ‘caIssuers’: (u’http://cert.int-x1.letsencrypt.org/’,), ‘OCSP’: (u’http://ocsp.int-x1.letsencrypt.org/’,), ‘serialNumber’: u’01839A051BF9D2873C0A3BAA9FD0227C54D1′, ‘notAfter’: ‘Apr 25 18:05:00 2016 GMT’, ‘version’: 3L, ‘subject’: (((‘commonName’, u’abi94oesede.de’),),), ‘issuer’: (((‘countryName’, u’US’),), ((‘organizationName’, u”Let’s Encrypt”),), ((‘commonName’, u”Let’s Encrypt Authority X1″),))} via 5
I’ve filed bug #813313 for this. So, this might explain why your blog post doesn’t appear on Planet Debian. Currently there seem 18 sites to be affected by this cert mismatch.
avoiding sni
Unlike most ways of getting SSL certificates letsencrypt uses the same certificate for multiple domains on one IP by default. Since using it I have stopped using SNI.
To me letsencrypt seems like the solution not the problem here.
Well, yes, can be a solution
Well, yes, can be a solution of course. Or a workaround.
OTOH I remember to have read in the early days of LetsEncrypt that there is a limitation somewhere and users are encouraged to aggregate certs/domains as much as possible. Don’t know if this is still valid or not.
But in the end, SNI is a standard and planet-venus seems to be buggy because it doesn’t honor this standard, right?