Dion Hulse 4:14 am on December 5, 2016
Tags: prio3 ( 56 ), ssl ( 13 )

SSL for wp.org

As wp.org is now a WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ domain, can we please get SSLSSL Secure Socket Layer - Encryption from the server to the browser and back. Prevents prying eyes from seeing what you are sending between your browser and the server. enabled for it?

ref https://wordpress.slack.com/archives/meta/p1480801420000002 / https://wordpress.slack.com/archives/meta/p1480909161000077

#ssl #prio3

Barry 10:12 pm on December 5, 2016

Hrm – we have hundreds (thousands?) of domains that redirect to WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/. Are we expected to have wildcard? SSLSSL Secure Socket Layer - Encryption from the server to the browser and back. Prevents prying eyes from seeing what you are sending between your browser and the server. for all of them?
- Dion Hulse 1:35 am on December 8, 2016
  
  Yes. All WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ domains should be available with SSLSSL Secure Socket Layer - Encryption from the server to the browser and back. Prevents prying eyes from seeing what you are sending between your browser and the server. enabled. This is just re-enforced by https://wordpress.org/news/2016/12/moving-toward-ssl/
  
  As to whether they require wildcard domains, that’s optional IMHO – if it’s viable to use a non-wildcard cert we can do that.
  An example of this is http://wordpressfoundation.org/ which also needs to have a cert made available for it (#2308-meta) but which probably doesn’t need a wildcard.
  
  For the lesser used redirect domains, of which I’m unsure of the exact number (I don’t see hundreds/thousands in the config files, so I assume they currently have no specific handling?), I’d be tempted to suggest that a roadmap to use Lets Encrypt where possible would be an option – however I understand that may not be possible due to trademark blocks and unknown list of subdomains that should actually be handled.
  - Barry 2:02 am on December 8, 2016
    
    All WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ domains should be available with SSLSSL Secure Socket Layer - Encryption from the server to the browser and back. Prevents prying eyes from seeing what you are sending between your browser and the server. enabled.
    
    Can you clarify what you mean by a WordPress.org domain?
    
    I don’t see hundreds/thousands in the config files,
    
    That’s correct – there are both catchall DNSDNS DNS is an acronym for Domain Name System - how you assign a human readable address to a website’s exact numeric coded location (ie. wordpress.org uses the actual IP address 198.143.164.252). and HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands. server configurations.
    
    Lets Encrypt probably isn’t a viable option because of the trademark issues.
    - Dion Hulse 4:16 am on December 16, 2016
      
      All WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ domains should be available with SSLSSL Secure Socket Layer - Encryption from the server to the browser and back. Prevents prying eyes from seeing what you are sending between your browser and the server. enabled.
      
      Can you clarify what you mean by a WordPress.org domain?
      
      Fair point. IMHO it should be any domain hosted on our infrastructure which gets traffic and/or linked to often.
      
      The many domains which are just typo/trademark catch-alls and don’t get any traffic aren’t super important. The fact they have a HTTPHTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands. server responding at all is more than I’d expect.
    - Konstantin Obenland 9:04 am on February 17, 2018
      
      Could lists.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ please be added to that list?
      See https://meta.trac.wordpress.org/ticket/629.
Dion Hulse 12:55 am on February 11, 2019

As a follow up to this, it’s also been requested that `*.wp.org` should work (which I disagree is needed, but mentioning here for completeness).

https://wordpress.slack.com/archives/C02QB8GMM/p1549574285810200
Jono Alderson 4:57 pm on June 26, 2019

Chipping in; SSLSSL Secure Socket Layer - Encryption from the server to the browser and back. Prevents prying eyes from seeing what you are sending between your browser and the server. on wp.org and on *.wp.org is absolutely necessary, and a matter of urgency (and embarrassment). We can’t claim to be paving cowpaths and offering suitable website solutions if our pages are all flagged as insecure by browsers and search engines.
Jono Alderson 4:11 pm on March 2, 2020

How do we move this forward?
Jono Alderson 10:21 am on March 5, 2020

Not that this should be necessary, but here are a few recent tweets from Google reinforcing the need for this:

https://twitter.com/JohnMu/status/1235251254797971457

https://twitter.com/JohnMu/status/1235316583523913731

How do we move this forward?
Jono Alderson 8:33 am on July 6, 2020

Any updates on this?
Tellyworth 4:51 am on September 8, 2021
Following up with some data thanks to Jono:

The wp.org domain in particular has thousands of backlinks from hundreds of domains (684 domains according to that tool, numbers vary). I don’t think we have any way to collect traffic stats.

If we’re able to come up with a short list of specific domains/subdomains that have sufficient visibility to make a SSLSSL Secure Socket Layer - Encryption from the server to the browser and back. Prevents prying eyes from seeing what you are sending between your browser and the server. certificate worthwhile, can we get a definitive yes/no on enabling them?

Current list as per this thread:
- wp.org
- *.wp.org
- lists.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/
- Dion Hulse 2:52 am on September 17, 2021
  
  lists.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/
  
  Lists is a little different than the rest of dotorg, as it’s Mailman + apacheApache Apache is the most widely used web server software. Developed and maintained by Apache Software Foundation. Apache is an Open Source software available for free. rather than going through the main LBs + nginxNGINX NGINX is open source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. It started out as a web server designed for maximum performance and stability. In addition to its HTTP server capabilities, NGINX can also function as a proxy server for email (IMAP, POP3, and SMTP) and a reverse proxy and load balancer for HTTP, TCP, and UDP servers. https://www.nginx.com/..
  
  Perhaps it could simply be reverse-proxied from the main LBs and switched entirely to HTTPsHTTPS HTTPS is an acronym for Hyper Text Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. This is especially helpful for protecting sensitive data like banking information. access? gaining the certs from the LBs..
Dion Hulse 2:49 am on September 17, 2021

It’s worth noting that previously we weren’t able to use LetsEncrypt for these things (such as when the wp.org domain was added), but I think that might’ve changed now?

We’ve got a lot of typo domains hosted on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ on LetsEncrypt certs, could we transition the wp.org domain over to that same setup? AFAIK we don’t have any nginxNGINX NGINX is open source software for web serving, reverse proxying, caching, load balancing, media streaming, and more. It started out as a web server designed for maximum performance and stability. In addition to its HTTP server capabilities, NGINX can also function as a proxy server for email (IMAP, POP3, and SMTP) and a reverse proxy and load balancer for HTTP, TCP, and UDP servers. https://www.nginx.com/. configs for the wp.org domain, it’s just hitting the default unhandled redirect-to-wordpress.org branch.

eg. https://wordpres.org/ has a LE cert.
- Jono Alderson 7:03 am on September 17, 2021
  
  That’d be lovely!