redirect https://debian.org/.well-known/openpgpkey/ to openpgpkey.debian.org (re...

diff --git a/modules/roles/templates/apache-www.debian.org.erb b/modules/roles/templates/apache-www.debian.org.erb
index a01cae2..e0fb2c6 100644 (file)
--- a/modules/roles/templates/apache-www.debian.org.erb
+++ b/modules/roles/templates/apache-www.debian.org.erb
@@ -335,6 +335,12 @@
    CustomLog /var/log/apache2/www-other-access.log privacyssl
    ErrorLog /var/log/apache2/www-other-error.log
 
+   # Legacy GPG versions (including 2.2.12 in buster/Debian 10) use the "direct method" instead
+   # of the "advanced method" which should be tried first according to the draft
+   # https://tools.ietf.org/html/draft-koch-openpgp-webkey-service
+   # also cf. RT#7828
+   Redirect /.well-known/openpgpkey/ https://openpgpkey.debian.org/.well-known/openpgpkey/debian.org/
+
    Redirect / https://www.debian.org/
 
    Use common-debian-service-ssl debian.org