<!--
	Duke University

	For problematic rules, see Duke-University-mismatches.xml.


	s3.amazonaws.com/s3.mirocommunity.org/duke/
	image.cdnllnwnl.xosnetwork.com	(cert: *.hs.llnwd.net; displays blank page)


	Nonfunctional domains:

		- dukehealth.org
		- www.dukehealth.org
		- dukeexechealth.org		(cert: members.dukeexechealth.org; shows that domain's data)
		- www.dukeexechealth.org	(ditto)
		- dukemedicine.org
		- construction.dukemedicine.org
		- www.dukemedicine.org
		- dukenursing.org		(cert: careers.lowes.com; shows that domain's data)
		- www.dukenursing.org		(ditto)
		- insidedukemedicine.org
		- www.insidedukemedicine.org

		*.duke.edu:

			- $
			- about
			- academiccouncil	(cert: voting.academiccouncil;
						shows that domain's data)
			- academics		(ssl_error_rx_record_too_long)
			- admit
			- arts			(ssl_error_rx_record_too_long)
			- atoz
			- calendar		(at least some paths 404)
			- static.calendar	(cert: calendar; redirects to calendar.duke.edu/static/;
						displays directory listing)
			- www.calendar		(at least some paths 404)
			- dhts			(cert: members.dukeexechealth.org; redirects to that domain)
			- diversity		(cert: goldenorb.trinity; shows that domain's data)
			- dukecard		(ssl_error_rx_record_too_long)
			- judge			(cert: catalog.library; 404s on some catalog paths)
			- archives.mc
			- www.mc		(cert: vml-r04-lamp02, self-signed, expired;
						prints "This website has not yet been configured")
			- medschool		(ditto)
			- www.medschool		(ditto)
			- newsoffice
			- coegne.nursing	(cert: dusonnet.nursing; shows that subdomain's data)
			- plasma.pratt		(prints "This is the secure site!")
			- research		(ssl_error_rx_record_too_long)
			- www.research		(ditto)
			- spotlights
			- www.spotlights
			- stratplan		(cert: BPIRData, self-signed; 403)
			- www.stratplan		(ditto)
			- trustees
			- visit
			- www

	Unknown:

		- staff.dukehealth.org	(times out over http)


	Fully covered subdomains:

		- www.math
		- wiki


	Mixed content:

		- Images on www.math from $self *

	* Secured by us

-->
<ruleset name="Duke.edu (partial)" platform="mixedcontent">

	<target host="*.duke.edu" />
	<target host="members.dukeexechealth.org" />
	<target host="goduke.com" />
	<target host="www.goduke.com" />


	<securecookie host="^.*\.duke\.edu$" name=".*" />


	<!--	At least the homepage redirects to http.

		Cert only matches !www.

		mobile/images/ 404s.	-->
	<rule from="^http://(?:www\.)?library\.duke\.edu/(css/|favicon\.ico|imgs?/|sites/)"
		to="https://library.duke.edu/$1" />

	<rule from="^http://(voting\.academiccouncil|login\.dhts|fds|(?:www\.)?(?:finance|hr|security|today)|www\.finsvc|giving|(?:blogs|catalog)\.library|www\.math|(?:(?:dusonnet|match|www)\.)?nursing|(?:(?:alertbar|bb-idp|brandbar|pwreset|shib|www)\.)?oit|inside\.pratt|(?:goldenorb\.)?trinity|wiki)\.duke\.edu/"
		to="https://$1.duke.edu/" />

	<!--	Cert doesn't match www.
		www works over http.	-->
	<rule from="^http://(?:www\.)?giving\.duke\.edu/"
		to="https://giving.duke.edu/" />

	<!--	At least the homepage redirects to http.
		temp/ paths redirect to http.	-->
	<rule from="^http://www\.mclibrary\.duke\.edu/(images/|style_\w+\.css$)"
		to="https://www.mclibrary.duke.edu/$1" />

	<!--	- Cert only matches *.pratt
		- At least some pages 302 to http
		- files/ 302s to http
		- wordpress/ 404s
						-->
	<rule from="^http://(?:www\.)?pratt\.duke\.edu/(modul|sit)es/"
		to="https://www.pratt.duke.edu/$1es/" />

	<!--	At least some pages 302 to http.
						-->
	<rule from="^http://it\.pratt\.duke\.edu/(modul|sit)es/"
		to="https://it.pratt.duke.edu/$1es/" />

	<rule from="^http://members\.dukeexechealth\.org/"
		to="https://members.dukeexechealth.org/" />

	<!--	Cert mismatch, at least homepage 404s over https.	-->
	<rule from="^http://(?:www\.)?goduke\.com/(ads2|css|fls|images|siteMediaPlayer|pics32)/"
		to="https://smnathletics.com/$1/" />


</ruleset>
