<!--
	Nonfunctional subdomains:

		- ace ¹
		- www.alumni ²
		- archives ¹
		- www.archives ²
		- asklib ³
		- bizmagazine ⁴
		- conferences ⁴
		- donate2 ²
		- esc ¹
		- grc ⁵
		- kroc ⁵

		- library subdomains:

			- 50years ⁶
			- catalog ⁶
			- ndcatalogplus ⁶
			- onesearch ⁴
			- rarebooks ⁷

		- morrisinn ⁸
		- my ⁹
		- mynotredame ²
		- ocw ²
		- or ⁵
		- photos ᵃ
		- undpress ᵇ

	¹ Plaintext reply
	² Dropped
	³ Redirects to http
	⁴ 404
	⁵ Refused
	⁶ Redirects to ^library
	⁷ Redirect loop
	⁸ Shows enigma; mismatched, CN: enigma.orourkehospitality.com
	⁹ 403
	ᵃ 403; mismatched, CN: astra.io
	ᵇ Shows another domain


	Problematic subdomains:

		- ndtoday.alumni ¹
		- cancerresearch ²
		- communityrelations ³
		- www.corecurriculum ⁴
		- wiki.crc ⁵
		- www.dante ⁶
		- ee ⁷
		- emergency ⁸
		- enlighten ³
		- givingtond ⁹
		- gmail ᵃ
		- www.gsu ⁴
		- internationalalumni ¹
		- www.latinostudies ⁴
		- www.law ⁴
		- onesearch.library ᵇ
		- map ᶜ
		- mynotredame ¹
		- www.news ⁴
		- www.opac ⁴
		- orlh ²
		- www.provost ⁴
		- www.rarebooks ⁶
		- www.registrar ⁶
		- riskmgt ᵈ
		- www.today ⁴
		- webmail ᵉ
		- youngalumni ¹

	¹ Works; mismatched, CN: *.imodules.com
	² 404
	³ 403
	⁴ 403, cert only matches *.nd.edu
	⁵ Works, self-signed
	⁶ Works, cert only matches *.nd.edu
	⁷ Mismatched, CN: engineering.nd.edu
	⁸ Server is configured for rc4 only
	⁹ Dropped
	ᵃ Google
	ᵇ Data differ
	ᶜ Works; expired, self-signed
	ᵈ Mixed css from www
	ᵉ Works; expired, mismatched


	Partially covered subdomains:

		- calendar ¹
		- (www.)gsu ²		(www → ^)
		- performingarts ¹
		- policy ²
		- www.rarebooks		(→ www.library)
		- riskmgt ²
		- www.undpress		(→ www3)

	¹ At least some pages redirect to http.
	² Avoiding false/broken MCB


	Fully covered subdomains:

		- (www.)
		- accounts
		- acms
		- admissions
		- africana
		- al
		- ame
		- annualreport2013
		- applymsba
		- applymsf
		- apps
		- architect
		- architecture
		- assyst
		- auxiliaryoperations
		- biology
		- blogs
		- budget
		- buildingcommunities
		- business
		- webapp.business
		- buy
		- campusmail
		- campusministry
		- campussafety
		- cancerresearch	(→ harpercancer)
		- careercenter
		- cbe
		- inside-p.cc
		- ccf
		- ccsp
		- cee
		- ceees
		- cemetery
		- centerformath
		- centerforsocialconcerns
		- centralreceiving
		- chemistry
		- classics
		- commencement
		- communityrelations	(→ publicaffairs)
		- communitystandards
		- conductor
		- continuousimprovement
		- controller
		- (www.)corecurriculum	(www → ^)
		- creativecomputing
		- creekhouse
		- creo
		- cse
		- cslc
		- csr
		- csrs
		- (www.)dante		(www → ^)
		- disabilityservices
		- diversity
		- donate
		- (www.)ee		(^ → www)
		- dulac
		- emergency
		- endeavor
		- energy
		- engineering
		- english
		- enlighten
		- equity
		- facultyhandbook
		- fieldhousemall
		- finance
		- financialaid
		- flowershop
		- food
		- fsntserv.foodserv
		- forum2008
		- fys
		- generalservices
		- globalhealth
		- gmail			(→ mail.google.com)
		- gradlife
		- graduateschool
		- green
		- harpercancer
		- help
		- homeunderthedome
		- honorcode
		- housing
		- hr
		- greentree.hr
		- iei
		- inside
		- international
		- investment
		- irish1card
		- irishlanguage
		- irishonline
		- irishstudies
		- www.irsurvey
		- issa
		- jobs
		- kaneb
		- kellogg
		- lafortune
		- (www.)latinostudies	(www → ^)
		- (www.)law		(www → ^)
		- encore.law
		- innopac.law
		- learning
		- least

		- library subdomains:

			- (www.)
			- alephprod
			- asset
			- bic
			- chemistry
			- discover
			- ejl
			- engineering
			- eresources
			- factotum
			- guides
			- link
			- m
			- onesearch
			- radlab
			- xerxes

		- listserv
		- login
		- magazine
		- marcomm
		- marketplace
		- medieval
		- msba
		- msf
		- msps
		- nanovic
		- ndfd
		- ndsp
		- (www.)news		(www → ^)
		- newsinfo
		- och
		- offcampus
		- oit
		- oithelp
		- old2gold
		- (www.)opac
		- orlh			(→ housing)
		- osa
		- ospir
		- ott
		- patentlaw
		- physics
		- playlikeachampion
		- politicalscience
		- postdocs
		- precollege
		- preprofessional
		- president
		- prism
		- (www.)provost		(www → ^)
		- publicaffairs
		- realestate
		- recsports
		- recycling
		- (www.)registrar	(www → ^)
		- remix
		- renovare
		- research
		- riskmanagement
		- riskmgt
		- sac
		- sakai
		- sakailogin
		- sao
		- science
		- search
		- shakespeare
		- shop
		- sniteartmuseum
		- socialconcerns
		- sociology
		- sp
		- solution
		- sri
		- stemeducation
		- step
		- stepancenter
		- strategicplan
		- studentaccounts
		- studentaffairs
		- studentemployment
		- supporting
		- surplus
		- (www.)today		(www → ^)
		- transportation
		- travel
		- treasury
		- trio
		- uc
		- ucc
		- uhs
		- utilities
		- was
		- webfile
		- weddingplanner
		- wellness
		- wiki
		- wireless
		- www3
		- youthsports


	These altnames don't exist:

		- irsurvey.nd.edu


	Mixed content:

		- css, on:

			- admissions, creativecomputing, and registrar from fonts.googleapis.com ¹
			- budget from finance ²
			- guides.library from www.library ²
			- listserv from www ²
			- policy from $self ¹
			- riskmgt from www ¹

		- Images, on:

			- apps from www ¹
			- architect from conductor ¹
			- architect from news ¹
			- webapp.business from business ¹
			- calendar from $self ¹
			- centerforsocialconcerns from socialconcerns ¹
			- chemistry from news ¹
			- csr from conductor ¹
			- (www.)dante from www ¹
			- diversity from $self ¹
			- energy from news ¹
			- engineering from $self ¹
			- help from $self ¹
			- investment from www ¹
			- least from $self ¹
			- eresources.library from www.library ¹
			- marketplace from $self ¹
			- nanovic from rarebooks.library ³
			- ndsp from conductor ¹
			- news from www ¹
			- old2gold from conductor ¹
			- ospir from conductor ¹
			- policy from emergency ¹
			- preprofessional from news ¹
			- preprofessional from science ¹
			- science from news ¹
			- science from www ¹
			- socialconcerns from $self ¹

		- Bugs, on:

			- learning from i.creativecommons.org ¹
			- marketplace from www.google.com ¹

	¹ Secured by us
	² Secured by us, minor
	³ Unsecurable

-->
<ruleset name="University of Notre Dame (partial)">

	<target host="nd.edu" />
	<target host="*.nd.edu" />
		<exclusion pattern="^http://riskmgt\.nd\.ed/+(?!favicon\.ico|images/|stylesheets/)" />
		<exclusion pattern="^http://calendar\.nd\.edu/+(?!(?:[\w.]+/)?themes/)" />
		<exclusion pattern="^http://(?:www\.)?gsu\.nd\.edu/+(?!assets/|favicon\.ico|images/|stylesheets/)" />
		<exclusion pattern="^http://performingarts\.nd\.edu/+(?!css/|favicon\.ico|images/)" />
		<exclusion pattern="^http://policy\.nd\.edu/+(?!assets/|favicon\.ico)" />


	<!--	Secured by server:
					-->
	<!--securecookie host="^\.cc\.nd\.edu$" name="^fos\.secure\.web\.server$" /-->
	<!--securecookie host="^help\.nd\.edu$" name="^ns_s$" /-->
	<!--securecookie host="^(jobs|login|sakailogin|shop)\.nd\.edu$" name="^JSESSIONID$" /-->
	<!--securecookie host="^law\.nd\.edu$" name="^_conductor_session$" /-->
	<!--securecookie host="^\.remix\.nd\.edu$" name="^SSESS[0-9a-f]{32}$" /-->
	<!--
		Not secured by server:
					-->
	<!--securecookie host="^(ame|cbe|ceees|cse|www\.ee|engineering|least|wireless)\.nd\.edu$" name="^zinstance$" /-->
	<!--securecookie host="^(applymsba|applymsf|webapp\.business)\.nd\.edu$" name="^(CFID|CFTOKEN|JSESSIONID)$" /-->
	<!--securecookie host="^apps\.nd\.edu$" name="^(CFID|CFTOKEN|JSESSIONID|SAO_LASTROLE)$" /-->
	<!--securecookie host="^(assyst|calendar|innopac\.law|onesearch\.library)\.nd\.edu$" name="^JSESSIONID$" /-->
	<!--securecookie host="^business\.nd\.edu$" name="^(ASP\.NET_SessionId|EkAnalytics|EkAnalytics|ecm)$" /-->
	<!--securecookie host="^\.cc\.nd\.edu$" name="^(badprotocol|fos\.web\.server)$" /-->
	<!--securecookie host="^inside-p\.cc\.nd\.edu$" name="^(JSESSIONID|UserAgentId|f5_cspm)$" /-->
	<!--securecookie host="^grc\.nd\.edu$" name="^(JSESSIONID|MOBILEFORMAT|ORIGINALURLTOKEN|SRVNAME|USERHASH|USERID|cfid|cftoken)$" /-->
	<!--securecookie host="^www\.irsurvey\.nd\.edu$" name="^ASP\.NET_SessionId$" /-->
	<!--securecookie host="^\.law\.nd\.edu$" name="^(III_EXPT_FILE|III_SESSION_ID|SESSION_LANGUAGE)$" /-->
	<!--securecookie host="^innopac\.law\.nd\.edu$" name="^SESSION_SCOPE$" /-->
	<!--securecookie host="^library\.nd\.edu$" name="^PHPSESSID$" /-->
	<!--securecookie host="^\.library\.nd\.edu$" name="^libraryndedu$" /-->
	<!--securecookie host="^ejl\.library\.nd\.edu$" name="^_ejournal_locator_session$" /-->
	<!--securecookie host="^guides\.library\.nd\.edu$" name="^_alaCarte_session$" /-->
	<!--securecookie host="^xerxes\.library\.nd\.edu$" name="^xerxessession__quicksearch$" /-->
	<!--securecookie host="^was\.nd\.edu$" name="^BIGipServerwas-443-b$" /-->
	<!--
		Could any of these cookies be secured safely?
								-->
	<!--securecookie host="^\.nd\.edu$" name="^III_ENCORE_PATRON$" /-->
	<!--securecookie host="^\.cc\.nd\.edu$" name="^(badprotocol|fos\.web\.server)$" /-->
	<!--securecookie host="^\.library\.nd\.edu$" name="^libraryndedu$" /-->

	<securecookie host="^(?:ame|applymsba|applymsf|apps|EkAnalytics|business|webapp\.business|cbe|inside-p\.cc|ceees|cse|www\.ee|engineering|grc|www\.irsurvey|law|(?:encore|innopac)?\.law|least|library|(?:ejl|guides|onesearch|xerxes)\.library|applymsba|applymsf|was|wireless)\.nd\.edu$" name=".+" />


	<rule from="^http://((?:accounts|acms|admissions|africana|al|ame|annualreport2013|applymsba|applymsf|apps|architect|architecture|assyst|auxiliaryoperations|biology|blogs|budget|buildingcommunities|business|webapp\.business|buy|calendar|campus(?:mail|ministry|safety)|careercenter|cbe|inside-p\.cc|ccf|ccsp|cee|ceees|cemetery|centerformath|centerforsocialconcerns|centralreceiving|chemistry|classics|commencement|communitystandards|conductor|continuousimprovement|controller|creativecomputing|creekhouse|creo|cse|cslc|csrs?|disabilityservices|diversity|donate|dulac|emergency|endeavor|energy|engineering|english|equity|facultyhandbook|fieldhousemall|finance|financialaid|flowershop|food|fsntserv\.foodserv|fys|generalservices|globalhealth|gradlife|graduateschool|green|help|homeunderthedome|honorcode|housing|hr|greentree\.hr|iei|inside|international|investment|irish(?:1card|language|online|studies)|www\.irsurvey|issa|jobs|kaneb|kellogg|lafortune|(?:encore|innopac)\.law|learning|least|(?:alephprod|asset|bic|chemistry|discover|ejl|engineering|eresources|factotum|guides|link|m|onesearch|radlab|xerxes)\.library|listserv|login|magazine|marcomm|marketplace|medieval|msba|msf|msps|nanovic|ndfd|ndsp|news|newsinfo|och|offcampus|oit|oithelp|old2gold|osa|ospir|ott|patentlaw|performingarts|physics|playlikeachampion|policy|politicalscience|postdocs|precollege|preprofessional|president|prism|realestate|recsports|recycling|remix|renovare|research|riskmanagement|riskmgt|sac|sakai|sakailogin|sao|science|search|shakespeare|shop|sniteartmuseum|socialconcerns|sociology|sp|solution|sri|stemeducation|step|stepancenter|strategicplan|studentaccounts|studentaffairs|studentemployment|supporting|surplus|transportation|travel|treasury|trio|ucc?|uhs|utilities|was|webfile|weddingplanner|wellness|wiki|wireless|www3?|youthsports)\.)?nd\.edu/"
		to="https://$1nd.edu/" />

	<rule from="^http://(?:cancerresearch|harpercancer)\.nd\.edu/"
		to="https://harpercancer.nd.edu/" />

	<rule from="^http://(?:communityrelations|publicaffairs)\.nd\.edu/"
		to="https://publicaffairs.nd.edu/" />

	<!--	Domains for which both ^foo and www.foo exist,
		but only ^foo works without caveats:
							-->
	<rule from="^http://(?:www\.)?(corecurriculum|dante|gsu|latinostudies|law|news|opac|provost|registrar|today)\.nd\.edu/"
		to="https://$1.nd.edu/" />

	<rule from="^http://(?:www\.)?ee\.nd\.edu/"
		to="https://www.ee.nd.edu/" />

	<rule from="^http://(?:enlighten|forum2008)\.nd\.edu/"
		to="https://forum2008.nd.edu/" />

	<rule from="^http://givingtond\.nd\.edu/.*"
		to="https://supporting.nd.edu/" />

	<rule from="^http://gmail\.nd\.edu/.*"
		to="https://mail.google.com/a/nd.edu" />

	<!--	Domains for which ^foo and www.foo exist,
		and both work with valid certs:
						-->
	<rule from="^http://(www\.)?(library)\.nd\.edu/"
		to="https://$1$2.nd.edu/" />

	<rule from="^http://orlh\.nd\.edu/"
		to="https://housing.nd.edu/" />

	<rule from="^http://www\.rarebooks\.nd\.edu/+(?:$|\?.*)"
		to="https://www.library.nd.edu/rarebooks/index.shtml" />

	<rule from="^http://www\.undpress\.nd\.edu/+(?:$|\?.*)"
		to="https://www3.undpress.nd.edu//index.php" />

</ruleset>
