Difference between revisions of "SSL certificate for moodle.org"

Jump to: navigation, search

Note: You are currently viewing documentation for Moodle 3.2. Up-to-date documentation for the latest stable version of Moodle is probably available here: SSL certificate for moodle.org.

(security template (not sure if this is the best template for this page, so feel free to change if you think of something better!))
m (small polishing)
Line 2: Line 2:
 
== Synopsis ==
 
== Synopsis ==
  
Your site may communicate with moodle.org sites - for example when it [[Notifications|checks for available updates]] or when it [[Automatic updates deployment|installs an update]]. This communication is done via the secure HTTPS protocol. Your site validates the SSL certificate of the moodle.org site (such as the [https://moodle.org/plugins Moodle plugins directory]) and verifies its identity. To pass this verification, there must be a certificate (in the PEM format) of the [http://en.wikipedia.org/wiki/Certificate_authority certificate authority (CA)] that issued the certificate for moodle.org installed at your server.  
+
When you, as an administrator, [[Notifications|check for available updates]] or [[Automatic updates deployment|install an update]], your Moodle site needs to communicate with moodle.org. This communication is done via the secure HTTPS protocol. Your Moodle site validates the SSL certificate of moodle.org (such as the [https://moodle.org/plugins Moodle plugins directory]) and verifies its identity. To pass this verification, there must be a certificate (in the PEM format) of the [http://en.wikipedia.org/wiki/Certificate_authority certificate authority (CA)] that issued the certificate for moodle.org installed on your server.  
  
The SSL certificate of moodle.org sites has been issued by the [https://www.digicert.com/digicert-root-certificates.htm DigiCert CA] and signed by their ''DigiCert High Assurance EV Root CA'' certificate.
+
The SSL certificate for moodle.org has been issued by the [https://www.digicert.com/digicert-root-certificates.htm DigiCert CA] and signed by their ''DigiCert High Assurance EV Root CA'' certificate.
  
 
== Problem ==
 
== Problem ==
  
If this CA certificate is missing, the remote site (moodle.org) can not be verified and your Moodle refuses to fetch the data (to protect you against so called man-in-the-middle attack). The exact location of that certificate at your server depends on the OS type and other settings. At Linux servers it may be typically found at ''/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt'' for example.
+
If this CA certificate is missing, the remote site (moodle.org) can not be verified and so your Moodle site will refuse to fetch the data (to protect you against so called man-in-the-middle attack). The exact location of the certificate on your server depends on the OS type and other settings. On Linux servers it may be typically found at ''/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt'' for example.
  
Missing CA certificate causes error when checking for available updates and attempting to install them.
+
A missing CA certificate results in an error when checking for available updates and attempting to install them.
  
 
== Solutions ==
 
== Solutions ==
Line 16: Line 16:
 
=== Update your operating system (recommended) ===
 
=== Update your operating system (recommended) ===
  
The recommended way to fix this problem is to update your server's operating system so that it contains recent SSL certificates of common certificate authorities. At Debian and RedHat based  distributions, these certificates are distributed in the ''ca-certificates'' package.  Gentoo servers provide them via the ''app-misc/ca-certificates'' ebuild. It's also a good idea to make sure that the OpenSSL libraries (libssl) and cURL libraries (libcurl) are up-to-date at your server.
+
The recommended way to fix this problem is to update your server's operating system so that it contains recent SSL certificates from common certificate authorities. For Debian and RedHat based  distributions, these certificates are distributed in the ''ca-certificates'' package.  Gentoo servers provide them via the ''app-misc/ca-certificates'' ebuild. It's also a good idea to make sure that the OpenSSL libraries (libssl) and cURL libraries (libcurl) are up-to-date on your server.
  
 
=== Provide the CA certificate manually ===
 
=== Provide the CA certificate manually ===
  
If updating the operating system is not an option for you and the administrator of the server refuses to update the CA certificates at the server (there's not a good argument for that though), here is a workaround for you. You can download the [https://www.digicert.com/testroot/DigiCertHighAssuranceEVRootCA.crt DigiCert High Assurance EV Root CA] certificate from [https://www.digicert.com/digicert-root-certificates.htm digicert.com] and put it into your ''moodledata/moodleorgca.crt'' file. If the certificate is found there, Moodle will use it instead of relying on the one provided by the operating system.
+
If updating the operating system is not an option for you and the administrator of the server refuses to update the CA certificates on the server (despite there being no good reason for not doing so), a possible workaround is to download the [https://www.digicert.com/testroot/DigiCertHighAssuranceEVRootCA.crt DigiCert High Assurance EV Root CA] certificate from [https://www.digicert.com/digicert-root-certificates.htm digicert.com] and put it into your ''moodledata/moodleorgca.crt'' file. If the certificate is found there, Moodle will use it instead of relying on the one provided by the operating system.
  
It must be highlighted that you really should get the CA certificate to your server's operating system as described above. The solution based on moodleorgca.crt should be considered as a temporary only.
+
It must be highlighted that having the CA certificate on your server's operating system as described above is really the recommended solution. The solution based on moodleorgca.crt should only be considered as a temporary fix.

Revision as of 14:39, 5 December 2012

Synopsis

When you, as an administrator, check for available updates or install an update, your Moodle site needs to communicate with moodle.org. This communication is done via the secure HTTPS protocol. Your Moodle site validates the SSL certificate of moodle.org (such as the Moodle plugins directory) and verifies its identity. To pass this verification, there must be a certificate (in the PEM format) of the certificate authority (CA) that issued the certificate for moodle.org installed on your server.

The SSL certificate for moodle.org has been issued by the DigiCert CA and signed by their DigiCert High Assurance EV Root CA certificate.

Problem

If this CA certificate is missing, the remote site (moodle.org) can not be verified and so your Moodle site will refuse to fetch the data (to protect you against so called man-in-the-middle attack). The exact location of the certificate on your server depends on the OS type and other settings. On Linux servers it may be typically found at /usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt for example.

A missing CA certificate results in an error when checking for available updates and attempting to install them.

Solutions

Update your operating system (recommended)

The recommended way to fix this problem is to update your server's operating system so that it contains recent SSL certificates from common certificate authorities. For Debian and RedHat based distributions, these certificates are distributed in the ca-certificates package. Gentoo servers provide them via the app-misc/ca-certificates ebuild. It's also a good idea to make sure that the OpenSSL libraries (libssl) and cURL libraries (libcurl) are up-to-date on your server.

Provide the CA certificate manually

If updating the operating system is not an option for you and the administrator of the server refuses to update the CA certificates on the server (despite there being no good reason for not doing so), a possible workaround is to download the DigiCert High Assurance EV Root CA certificate from digicert.com and put it into your moodledata/moodleorgca.crt file. If the certificate is found there, Moodle will use it instead of relying on the one provided by the operating system.

It must be highlighted that having the CA certificate on your server's operating system as described above is really the recommended solution. The solution based on moodleorgca.crt should only be considered as a temporary fix.