Notable changes today:
Switch to compat-dhe: T104281 - pending gerrit commit to switch: https://gerrit.wikimedia.org/r/#/c/222023/ . Probably going out today (July 6).
Dashboard for negotiated protocols/ciphers: https://tessera.wikimedia.org/dashboards/6/tls

submitted to the Chromium HSTS Preload list

The Chromium project indicates that they are willing to special-case certain requests, and that petitioners should write to Adam Langley <agl@google.com>. Maybe they could accelerate our inclusion in the list?

I think that's mostly about agl special-casing exemptions to the list of rules for automatic inclusion to the master list in git (the ones about restrictions on implementation details), not about accelerating the process for getting the updated list into browsers faster. The list gets fairly regularly batch-updated in git, and then I imagine that factors into merging into release branches for Chrom(e|ium) or pulls into remote release branches for FF/IE/Safari at regular intervals. agl actually checks and commits the list updates himself, I'm sure he's noticed our submission if that has any bearing on anything :)

The original point of this (now ~2 years old) tracking task was to track the very long tail of known but relatively-minor issues preventing us from reaching a full transition to modern HTTPS-only for all public-facing production things that the Foundation has control over, in the wake the transition for our major public hostnames announced in https://blog.wikimedia.org/2015/06/12/securing-wikimedia-sites-with-https/ . This ticket has a danger of becoming an undead meta-task as more sub-tasks might topically accrete to it over time. It's not intended to replace the idea of a tag or a workboard column, after all, and we have such a thing in the TLS column of the Traffic workboard for tracking all other ongoing TLS improvements. The remaining set of valid open tasks is fairly small at this point and a few of them are near closing, so we're going to try to wind this ticket down completely over the next several months, and I'm going to unlink a few on categorical grounds today.

Remaining open tasks directly linked into here which need work before this closes:

• T132521 Enforce HTTPS+HSTS on remaining one-off sites in wikimedia.org that don't use standard cache cluster termination - still valid due to a couple of relevant subtasks:
  • T128559 store.wikimedia.org HTTPS issues - Still outstanding on the HSTS issue here
  • T137161 Fix nits in HTTPS/HSTS configs in externally-hosted fundraising domains - Looks due to close any day now, hopefully
• T133548 Create a secure redirect service for large count of non-canonical / junk domains - Still relevant, hoping to close this out in the latter half of 2017
• T168919 stream.wikimedia.org: remove legacy rcstream/socket.io HTTPS redirect hole punches - Relevant and newly-added (was missing)

Stuff I'm unlinking today as categorically inappropriate or unnecessary in the view of the original transition's long tail:

• T92002 implement Public Key Pinning (HPKP) for Wikimedia domains - Unlinking, this is just a general improvement we'd like to have, but not required to close this IMHO (similar to other issues like CAA support, etc)
• T153563 Consider switching to HTTPS for Wikidata query service links - Unlinking, as this is categorically an application-layer issue, and WDQS's actual basic TLS termination is standard and acceptable.

So with these changes and cleanups in the past few weeks, we're basically down to two outstanding issues here from the original context:

• T133548 - Create a secure redirect service for large count of non-canonical / junk domains - Still relevant, there's some subtasks underneath about LE scaling, hoping to close this out in the latter half of 2017
• T128559 - store.wikimedia.org HTTPS issues - Still outstanding on the HSTS issue here, no response lately...