ether/pad — Issue #306: "Comet" URLs make it difficult to properly set up SSL
Author: AlainKnaff
Created: 2011-11-12 19:43:19+00:00
State: open

On some browsers (such as Opera and Konqueror) but not on others (Firefox, Midori, Nokia N900), etherpad generates URLs such as

2143539285689.comet.hitchhiker.org.lu

This makes it difficult to properly set up SSL, as this would need a wildcard certificate (*.comet.hitchhiker.org.lu) which are prohibitively expensive on some CAs.

On other CAs (such as startssl.com class2) they are affordable, but even there these URLs would cause problems as soon as you throw "team sites" in the mix.

Indeed, visiting a pad in a team site ("sub") with one of the 2 affected browsers will query an URL such as the following:

2143539285689.comet.sub.hitchhiker.org.lu

In order to cover this, you'd need a wildcard certificate for *.comet.*.hitchhiker.org.lu
However, even startSSL refuses to issue such double wildcard certificates...

Wouldn't it be preferable to generate the "comet" URLs at local paths rather than sub domains? (hitchhiker.org.lu/comet/243y736) Or is this just a case of browsers "seeing things"...