We need to renew the SSL cert for benefactorevents.wikimedia.org by 2017-03-02, the original certificate was requested in T107059.
We should consider switching this certificate from the existing CA to Let's Encrypt (https://letsencrypt.org) which is what we're doing for many of our domains. This approach would be self-serve and automatable for Trilogy, instead of having to redo the renewal shuffle with WMF staff annually.
Please note that some potential details for this are also on private task T156849. However, relevant info has been copied to this task.
@Jgreen Yes, I will be the point of contact for this update. This domain is hosted using Azure's App Service which requires us to manually upload a PFX cert file to update the cert. While we could certainly do this with Let's Encrypt, because of the short-lived expiration (90 days) of those certs we would be making this manual update regularly. We would prefer to stick with the previous cert vendor for now to limit updates to once per year.
@EWilfong_WMF: Just wanted to check, we'll be generating the private key, csr, and ordering the certificate.
In the past, you provided your gpg key to send over the files to you:
Can you advise what email we should send things to?
I'll handle key/csr generation and cert ordering. Then I'll pgp encrypt and email the key over to Eric @ Trilogy (with the public cert attached as well.)
Additionally, we will store a copy of these in the fundraising key/ssl store.
I've emailed the new public cert and private key file (the key being pgp encrypted) over to @EWilfong_WMF.