Subject: [CODE4LIB] hotel reservation window

From: "Kevin S. Clarke" <[email-masked]>
Date: Thu, 17 Dec 2009 09:27:37 -0500

Hi all,

It seems, overnight, the window for our block of rooms for Code4LibCon
lost the Friday and Saturday dates that were added yesterday.  I have
a call into the hotel to get those back into the online system so when
you book a room you can choose to stay those extra nights if you'd
like.  If in the meantime you'd like to go ahead and book your room,
you could call the hotel directly at 828-210-3006 (ask for Paula
Haywood).

Kevin

---

From: John Wynstra <[email-masked]>
Date: Thu, 17 Dec 2009 15:02:21 -0600

Out of curiosity, did anyone else using ipsCA certs receive notification 
that due to the coming expiration of their root CA (December 29,2009), 
they would need a reissued cert under a new root CA?

I am uncertain as to how this new Root CA will become a part of the 
browsers trusted roots without some type of user action including a 
software upgrade, but the following library website instructions lead me 
to believe that this is not going to be smooth.  http://bit.ly/53Npel

We are just about to go live with EZProxy in January with an ipsCA cert 
issued a few months ago, and I am not about to do that if I have serious 
browser support issue.

-- 
<><><><><><><><><><><><><><><><><><><>
John Wynstra
Library Information Systems Specialist
Rod Library
University of Northern Iowa
Cedar Falls, IA  50613
[email-masked]
(319)273-6399
<><><><><><><><><><><><><><><><><><><>

---

From: "Weidner, Amy" <[email-masked]>
Date: Thu, 17 Dec 2009 15:16:21 -0600

Hi, John.  I sure did.  Looks like the email is legit.  Lots of talk about it on the ezproxy listserv today, here's the archive: http://ls.suny.edu/read/?forum=ezproxy&sb=1

In short from those who have installed the new cert, there are no problems with IE but Firefox, Safari and Chrome are experiencing certificate warnings.  HTH

Amy Weidner
Digital Resources Librarian
Benedictine University
630/ 829.6066
630/ 960.9451 (fax)
[email-masked]

---

From: John Wynstra <[email-masked]>
Date: Thu, 17 Dec 2009 15:19:43 -0600

Thanks Amy.  I'll join that list.  Would have been a more appropriate 
place for this post.

---

From: "Walker, David" <[email-masked]>
Date: Thu, 17 Dec 2009 13:40:04 -0800

Hi John,

I also got this email. We also recently installed an ipsCA wildcard cert for a test EZProxy install.

Looking at the details of our ipsCA wildcard certificate in Firefox, though, I can see the chain of certificates going up to the root ipsCA cert.  

Firefox says that that root certificate -- ipsCA CLASEA1 Certificate Authority -- is good until 2025. I see the same thing in IE, Safari, and I assume every other browser I might check.

Do you see that too?

--Dave

==================
David Walker
Library Web Services Manager
California State University
http://xerxes.calstate.edu
________________________________________
From: Code for Libraries [[email-masked]] On Behalf Of John Wynstra [[email-masked]]
Sent: Thursday, December 17, 2009 1:02 PM
To: [email-masked]
Subject: [CODE4LIB] ipsCA Certs

---

From: "Walker, David" <[email-masked]>
Date: Thu, 17 Dec 2009 13:42:18 -0800

I see now that I'm looking at the intermediate certificate.  The root does expire in 2009.

Nevermind. :-)

--Dave

==================
David Walker
Library Web Services Manager
California State University
http://xerxes.calstate.edu
________________________________________
From: Walker, David
Sent: Thursday, December 17, 2009 1:40 PM
To: Code for Libraries
Subject: RE: [CODE4LIB] ipsCA Certs

Hi John,

Do you see that too?

--Dave

==================
David Walker

---

From: Tim McGeary <[email-masked]>
Date: Fri, 18 Dec 2009 11:18:06 -0500

I'm a little dismayed at the eleventh hour posting of the email.  It 
makes it feel illegitimate, but I have had other confirmation that it is 
legit, too.

Another thing to worry about before Christmas...

Tim McGeary
Team Leader, Library Technology
Lehigh University
610-758-4998
[email-masked]

[email-masked]
GTalk/Yahoo/Skype: timmcgeary

---

From: John Wynstra <[email-masked]>
Date: Fri, 18 Dec 2009 11:03:52 -0600

I'm done with the worry part at this point.

We are going to purchase a certificate elseware, because we can't wait 
for ipsCA root Cert to get into popular browsers.  It creates a really 
bad user experience if our users are getting what seem to them to be 
"WARNING--YOUR ARE ABOUT TO DIE" messages from their browser when coming 
through or to our site.  If we train them that it is OK to make an 
exception for our cert, we are doing them a disservice and training them 
to take risks.

I know other server admins on campus are purchasing certs also.  I wish 
I was in the certificate business today--not really.

Tim McGeary wrote:
>> Looking at the details of our ipsCA wildcard certificate in Firefox, 
>> though, I can see the chain of certificates going up to the root ipsCA 
>> cert.
>>
>> Firefox says that that root certificate -- ipsCA CLASEA1 Certificate 
>> Authority -- is good until 2025. I see the same thing in IE, Safari, 
>> and I assume every other browser I might check.
>>
>> Do you see that too?
>>
>> --Dave
>>
>> ==================
>> David Walker

---

From: Yitzchak Schaffer <[email-masked]>
Date: Fri, 18 Dec 2009 12:23:18 -0500

On 12/18/2009 12:03 PM, John Wynstra wrote:
> for ipsCA root Cert to get into popular browsers.

Ergh.  Anyone have any fresh research on cheap education wildcard certs? 
  We're using SSL on three (soon to be four) publicly-used hosts.  TLD 
is .org though.

-- 
Yitzchak Schaffer
Systems Manager
Touro College Libraries
33 West 23rd Street
New York, NY  10010
Tel (212) 463-0400 x5230
Fax (212) 627-3197
Email [email-masked]

Access Problems? Contact [email-masked]

---

From: John Wynstra <[email-masked]>
Date: Fri, 18 Dec 2009 11:46:07 -0600

The following from EZProxy list offers some info along these lines.

http://ls.suny.edu/read/archive?id=1183059

The vendor recommended in this post appears to be a reseller(maybe 
owner) of multiple certs including Verisign and Thawte from what I can 
tell.

We are going with either Thawte or Digicert since our campus already has 
certs from these Vendors.  My personal experience has been with Thawte, 
but not with their wildcard certs.

Yitzchak Schaffer wrote:
>  We're using SSL on three (soon to be four) publicly-used hosts.  TLD is 
> .org though.
>

---

From: Nate Vack <[email-masked]>
Date: Fri, 18 Dec 2009 12:18:44 -0600

On Fri, Dec 18, 2009 at 11:46 AM, John Wynstra <[email-masked]> wrote:

> certs from these Vendors.  My personal experience has been with Thawte, but
> not with their wildcard certs.

Depending on how cheap "cheap" needs to be, I've actually had good
experiences with GoDaddy's wildcard certs. Their site is irritating,
but they're cheap and probably aren't gonna die tomorrow.

Cheers,
-Nate

---

From: susan teague rector <[email-masked]>
Date: Thu, 24 Dec 2009 08:17:52 -0500

john, we had the same problem. we ended up buying from another vendor 
last minute as this wasn't going to be a smooth process
i can't believe they didn't give us all more notice

John Wynstra wrote:
> Out of curiosity, did anyone else using ipsCA certs receive 
> notification that due to the coming expiration of their root CA 
> (December 29,2009), they would need a reissued cert under a new root CA?
>
> software upgrade, but the following library website instructions lead 
> me to believe that this is not going to be smooth.  http://bit.ly/53Npel
>
> We are just about to go live with EZProxy in January with an ipsCA 
> cert issued a few months ago, and I am not about to do that if I have 
> serious browser support issue.
>
>

---

From: Yitzchak Schaffer <[email-masked]>
Date: Fri, 25 Dec 2009 12:38:47 -0500

Whew.  Just survived an Ubuntu dist-upgrade which broke our Apache SSL 
virtual hosts configuration.  I had thought the foulup on the test 
server was because we were testing various certs in the wake of the root 
CA expiration!

We estimate that 15-25% of our users will be affected (the new root CA 
seems to work in Google Chrome as well as IE), and that a new wildcart 
cert could be had for $40 or $80 from StartSSL for two years - not quite 
sure yet what level verification we'd need, hence the 40/80 doubt.

We're running multiple name-based hosts at one IP address (for 
encryption), hence the reliance on the wildcart cert.  We could 
conceivably get more IP addresses, but I don't know if I want to take 
that one up with IT.  Methinks we're going to try scraping together 
40/80 bucks, which isn't as simple here as it may sound.

Twitter's been very helpful in keeping up with this.