Migrate most standard public TLS certificates to CertCentral issuance
Open, NormalPublic

Description

Q2 TEC1 Goal:

  • Migrate legacy LE certs to certcentral
  • Explicitly out of scope public certs: the big unified wildcard, frack, labs

Private services:

  • librenms.wikimedia.org
  • netbox.wikimedia.org
  • tendril.wikimedia.org
  • icinga.wikimedia.org

Public services:

  • apt.wikimedia.org
  • archiva.wikimedia.org
  • dumps.wikimedia.org
  • gerrit.wikimedia.org
  • gerrit-slave.wikimedia.org
  • lists.wikimedia.org
  • mirrors.wikimedia.org

Mail, not webservers:

  • mx1001.wikimedia.org
  • mx2001.wikimedia.org
There are a very large number of changes, so older changes are hidden. Show Older Changes

Change 475762 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Notified puppet_svc on certificate file changes

https://gerrit.wikimedia.org/r/475762

Change 475757 merged by Vgutierrez:
[operations/puppet@production] archiva: Use certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/475757

Change 475765 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] archiva: Remove old LE puppetization

https://gerrit.wikimedia.org/r/475765

Change 475765 merged by Vgutierrez:
[operations/puppet@production] archiva: Remove old LE puppetization

https://gerrit.wikimedia.org/r/475765

Vgutierrez updated the task description. (Show Details)Mon, Nov 26, 3:33 PM

Change 475762 merged by Vgutierrez:
[operations/puppet@production] certcentral: Notified puppet_svc on certificate file changes

https://gerrit.wikimedia.org/r/475762

Dzahn updated the task description. (Show Details)Mon, Nov 26, 6:04 PM

icinga-old has been removed from DNS and was only temporary. T209738 https://gerrit.wikimedia.org/r/#/c/operations/dns/+/474392/ so it doesn't apply anymore.

Krenair updated the task description. (Show Details)Mon, Nov 26, 6:07 PM
Krenair updated the task description. (Show Details)

Change 475955 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide TLS certificates for apt.wikimedia.org

https://gerrit.wikimedia.org/r/475955

Change 475956 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] installserver: Deploy certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/475956

Change 475955 merged by Vgutierrez:
[operations/puppet@production] certcentral: Provide TLS certificates for apt.wikimedia.org

https://gerrit.wikimedia.org/r/475955

Change 475956 merged by Vgutierrez:
[operations/puppet@production] installserver: Deploy certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/475956

Change 475965 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] install_server: Remove old LE puppetization

https://gerrit.wikimedia.org/r/475965

Mentioned in SAL (#wikimedia-operations) [2018-11-27T08:41:19Z] <vgutierrez> Use a TLS certificate managed by certcentral in apt.wm.o - T207050

Change 475968 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide dhparam.pem when deploying certificates

https://gerrit.wikimedia.org/r/475968

Change 475978 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] tendril: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475978

Change 475979 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] librenms: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475979

Change 475980 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] netbox: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475980

Change 475981 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] archiva: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475981

Change 476020 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] sslcert: Avoid /etc/ssl/dhparam.pem redeclaration

https://gerrit.wikimedia.org/r/476020

Change 476020 abandoned by Vgutierrez:
sslcert: Avoid /etc/ssl/dhparam.pem redeclaration

https://gerrit.wikimedia.org/r/476020

Change 475979 abandoned by Vgutierrez:
librenms: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475979

Change 475980 abandoned by Vgutierrez:
netbox: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475980

Change 476025 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] netmon: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/476025

Change 475968 merged by Vgutierrez:
[operations/puppet@production] certcentral: Handle common requirements for certcentral clients

https://gerrit.wikimedia.org/r/475968

Change 475965 merged by Vgutierrez:
[operations/puppet@production] install_server: Remove old LE puppetization

https://gerrit.wikimedia.org/r/475965

Vgutierrez updated the task description. (Show Details)Tue, Nov 27, 2:29 PM

Change 475978 merged by Vgutierrez:
[operations/puppet@production] tendril: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475978

Change 475981 merged by Vgutierrez:
[operations/puppet@production] archiva: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/475981

Change 476025 merged by Vgutierrez:
[operations/puppet@production] netmon: sslcert::dhparam needs to be included especifically now

https://gerrit.wikimedia.org/r/476025

Change 476208 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide TLS certificates for icinga.wm.o

https://gerrit.wikimedia.org/r/476208

Change 476209 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] icinga: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476209

Change 476212 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: check for already declared LE Intermediate certs

https://gerrit.wikimedia.org/r/476212

Change 476208 merged by Vgutierrez:
[operations/puppet@production] certcentral: Provide TLS certificates for icinga.wm.o

https://gerrit.wikimedia.org/r/476208

Change 476212 merged by Vgutierrez:
[operations/puppet@production] certcentral: check for already declared LE Intermediate certs

https://gerrit.wikimedia.org/r/476212

Change 476215 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] icinga: Use certcentral managed TLS certificate for icinga.wm.o

https://gerrit.wikimedia.org/r/476215

Change 476209 merged by Vgutierrez:
[operations/puppet@production] icinga: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476209

Mentioned in SAL (#wikimedia-operations) [2018-11-28T09:14:52Z] <vgutierrez> Use a TLS certificate managed by certcentral in icinga.wm.o - T207050

Change 476215 merged by Vgutierrez:
[operations/puppet@production] icinga: Use certcentral managed TLS certificate for icinga.wm.o

https://gerrit.wikimedia.org/r/476215

Change 476219 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] icinga: Get rid of old LE puppetization

https://gerrit.wikimedia.org/r/476219

Vgutierrez updated the task description. (Show Details)Wed, Nov 28, 9:36 AM

Change 476219 merged by Vgutierrez:
[operations/puppet@production] icinga: Get rid of old LE puppetization

https://gerrit.wikimedia.org/r/476219

Change 476275 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide TLS certificates for dumps.wikimedia.org

https://gerrit.wikimedia.org/r/476275

Change 476276 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] dumps: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476276

Change 476275 merged by Vgutierrez:
[operations/puppet@production] certcentral: Provide TLS certificates for dumps.wikimedia.org

https://gerrit.wikimedia.org/r/476275

Change 476276 merged by Vgutierrez:
[operations/puppet@production] dumps: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476276

Change 476281 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] dumps: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476281

Change 476281 merged by Vgutierrez:
[operations/puppet@production] dumps: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476281

Mentioned in SAL (#wikimedia-operations) [2018-11-28T15:24:03Z] <vgutierrez> use a certcentral managed TLS certificate in dumps.wm.o - T207050

Change 476283 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] dumps: Get rid of the old LE puppetization

https://gerrit.wikimedia.org/r/476283

Change 476283 merged by Vgutierrez:
[operations/puppet@production] dumps: Get rid of the old LE puppetization

https://gerrit.wikimedia.org/r/476283

Vgutierrez updated the task description. (Show Details)Wed, Nov 28, 3:38 PM

Change 476284 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide TLS certificates for gerrit/gerrit-slave.wm.o

https://gerrit.wikimedia.org/r/476284

Change 476285 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] gerrit: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476285

Change 476284 merged by Vgutierrez:
[operations/puppet@production] certcentral: Provide TLS certificates for gerrit/gerrit-slave.wm.o

https://gerrit.wikimedia.org/r/476284

Change 476285 merged by Vgutierrez:
[operations/puppet@production] gerrit: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476285

Change 476301 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] gerrit: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476301

Change 476315 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] gerrit: Avoid certcentral::cert interfering with labs instances

https://gerrit.wikimedia.org/r/476315

Change 476315 merged by Vgutierrez:
[operations/puppet@production] gerrit: Avoid certcentral::cert interfering with labs instances

https://gerrit.wikimedia.org/r/476315

Change 476301 merged by Vgutierrez:
[operations/puppet@production] gerrit: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476301

Mentioned in SAL (#wikimedia-operations) [2018-11-29T08:04:22Z] <vgutierrez> replacing TLS certificates in gerrit - T207050

Change 476459 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] gerrit: Switch between old LE puppetization and certcentral using hiera

https://gerrit.wikimedia.org/r/476459

Vgutierrez updated the task description. (Show Details)Thu, Nov 29, 9:09 AM

Change 476510 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Mimick letsencrypt::cert::integrated key_group

https://gerrit.wikimedia.org/r/476510

Change 476521 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide TLS certificates for lists.wikimedia.org

https://gerrit.wikimedia.org/r/476521

Change 476510 merged by Vgutierrez:
[operations/puppet@production] certcentral: Mimick letsencrypt::cert::integrated key_group

https://gerrit.wikimedia.org/r/476510

Change 476521 merged by Vgutierrez:
[operations/puppet@production] certcentral: Provide TLS certificates for lists.wikimedia.org

https://gerrit.wikimedia.org/r/476521

Change 476459 merged by Vgutierrez:
[operations/puppet@production] gerrit: Switch between old LE puppetization and certcentral using hiera

https://gerrit.wikimedia.org/r/476459

Change 476860 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] lists: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476860

Change 476869 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] lists: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476869

Change 476872 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] lists: Get rid of the old LE puppetization

https://gerrit.wikimedia.org/r/476872

Change 476860 merged by Vgutierrez:
[operations/puppet@production] lists: Deploy the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476860

Change 476874 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] lists: Fix the group name in certcentral::cert

https://gerrit.wikimedia.org/r/476874

Change 476874 merged by Vgutierrez:
[operations/puppet@production] lists: Fix the group name in certcentral::cert

https://gerrit.wikimedia.org/r/476874

Change 476877 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Fix /etc/centralcerts permissions

https://gerrit.wikimedia.org/r/476877

Change 476877 merged by Vgutierrez:
[operations/puppet@production] certcentral: Fix /etc/centralcerts permissions

https://gerrit.wikimedia.org/r/476877

Mentioned in SAL (#wikimedia-operations) [2018-12-11T13:48:21Z] <vgutierrez> Use certcentral TLS managed certificate in lists.wikimedia.org - T207050

Change 476869 merged by Vgutierrez:
[operations/puppet@production] lists: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/476869

Vgutierrez updated the task description. (Show Details)Tue, Dec 11, 2:02 PM

Change 476872 merged by Vgutierrez:
[operations/puppet@production] lists: Get rid of the old LE puppetization

https://gerrit.wikimedia.org/r/476872

Change 478943 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide certificates for mirrors.wikimedia.org

https://gerrit.wikimedia.org/r/478943

Change 478944 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] mirrors: Deploy certcentral TLS managed certificate

https://gerrit.wikimedia.org/r/478944

Change 478943 merged by Vgutierrez:
[operations/puppet@production] certcentral: Provide certificates for mirrors.wikimedia.org

https://gerrit.wikimedia.org/r/478943

Change 478944 merged by Vgutierrez:
[operations/puppet@production] mirrors: Deploy certcentral TLS managed certificate

https://gerrit.wikimedia.org/r/478944

Change 478948 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] mirrors: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/478948

Change 478950 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] mirrors: Get rid of the old LE puppetization

https://gerrit.wikimedia.org/r/478950

Change 478948 merged by Vgutierrez:
[operations/puppet@production] mirrors: Use the certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/478948

Mentioned in SAL (#wikimedia-operations) [2018-12-11T15:06:49Z] <vgutierrez> Use certcentral managed TLS certificate in mirrors.wikimedia.org - T207050

Vgutierrez updated the task description. (Show Details)Tue, Dec 11, 3:08 PM

Change 478950 merged by Vgutierrez:
[operations/puppet@production] mirrors: Get rid of the old LE puppetization

https://gerrit.wikimedia.org/r/478950

Done, resolve?

Change 479226 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Provide TLS certificates for mx[12]001.wikimedia.org

https://gerrit.wikimedia.org/r/479226

Change 479226 merged by Vgutierrez:
[operations/puppet@production] certcentral: Provide TLS certificates for mx[12]001.wikimedia.org

https://gerrit.wikimedia.org/r/479226

Change 479244 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] certcentral: Allow puppet_svc to be undef

https://gerrit.wikimedia.org/r/479244

Change 479245 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] mx: Deploy certcentral managed TLS certificate

https://gerrit.wikimedia.org/r/479245