It was found out that some warning messages connected with self-managed self-signed certificate used in the current luci can be removed (proved with Firefox and lynx) if either CN (CommonName) is set to the hostname serving luci or subjectAltName (one of x509 extensions) contains correct IP (IP item) or hostaname (DNS item) -- see also RFC 2818 (section 3.1) and RFC 5280 (section 4.2.1.6). There should be made a best afford to removed these unnecessary warnings, i.e. before the certificate is generated ad-hoc with the first use of luci, external IPs should be detected and respective hostnames resolved and added into certificate configuration file.
Created attachment 467524 [details] Firefox: initial warning about self-signed certificate (contains one extra unnecesary warning)
Created attachment 467525 [details] Firefox: initial warning about self-signed certificate (unnecesary warning removed)
Created attachment 467526 [details] Firefox: "add exception" dialog (contains one extra unnecesary warning)
Created attachment 467527 [details] Firefox: "add exception" dialog (unnecesary warning removed)
With lynx, there is one unnecessary question (that must be aswered with every resposponse): SSL error:host(node1)!=cert(CN<luci high availability management server>)-Continue? (y)
Commit http://git.fedorahosted.org/git/?p=luci.git;a=commit;h=9f5ec97d5e5c0f221939f2d383581a86bbc68233 addresses this issue. By default, prior to generating the self-managed certificate (which takes place if no such already exists), there is a try to get external IPs and hostnames and add them into certificate configuration file - this can be disabled by manually editing this cert. config. file (/var/lib/luci/etc/cacert.config) in that way that "###" is not found at the end of this file before first start of the service (but it may be a good idea to fill intended address manually) Of course, the best is to use certificate coming from own cert. infrastructure (e.g. corporate or even commercial?) and set it in sysconfig file (see bug #661386) - this would possibly suppress warnings from the web browsers (if not respective CA preconfigured directly in web browser, it can be e.g. deployed to all machines in organization in batch)
Note: this was fixed in the context of work on pkg-update upstream branch which means the fix ties closely to the major change brought from this branch into main-line upstream code in connection with bug #660446