Remove explore. alternative name from HCA portal cert

[dsotirho-ucsc]

See below for description.

[dsotirho-ucsc]

Assignee to provide description.

[hannes-ucsc]

The ACM certificate for the HCA Data Portal currently lists an subject alternative name for explore.data.humancellatlas.org (the Data Browser domain), in addition to the domain name of the portal (data.humancellatlas.org). The certificate is hosted in the platform-hca-portal account which the Azul team has no access to. The explore.data.humancellatlas.org zone for the Data Browser, however, is managed by my team, and is hosted in a different account (platform-hca-prod).

This discrepancy caused a disruption during the automatic renewal of the certificate: ACM failed to renew the portal certificate because the corresponding validation record was missing from the Route 53 zone for the browser. Luckily, someone at Sanger noticed the expiring certificate and we were able to fix this temporarily by create validation records for the portal certificate (managed by CC) in the Data Browser account managed by the Azul team.

We need to clearly separate the portal from the browser. The portal certificate should not list a browser domain name as a subject alternative name. The subject alternative name serves no purpose in that certificate because the Data Browser uses a separate certificate managed by Azul. We risk running into renewal problems again if someone accidentally removes the validation records that we created as a temporary fix.

Please create a new portal certificate that does not list explore.data.humancellatlas.org as a subject alternative name, and associate that certificate with the CloudFront distribution for the portal. Please let the Azul team know when that is done so that we can remove (blocker DataBiosphere/azul#6734) the domain validation records that we created temporarily.

[NoopDog]

Thanks, will fix.

[alexfomin]

To complete separation of data.humancellatlas.org and explore.data.humancellatlas.org it would be desirable to transfer Route53 management for data.humancellatlas.org zone from platform-hca-prod to platform-hca-portal.

Please review the configuration of Route53 for data.humancellatlas.org in platform-hca-prod. It should be separate from explore.data.humancellatlas.org hosted zone. If that is the case, please export the zone so that we can recreate it in platform-hca-portal and request change in delegation for management from the humancellatlas.org admin.