Let's Encrypt issues the certificates one hour in the past to attempt to minimize clock skew issues. While this is enough for the non big-public sites (icinga, phabricator...) the global unified wildcard certificate needs to be issued days before being deployed.
This needs to be configurable per certificate on certcentral.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Vgutierrez | T213705 Deploy managed LetsEncrypt certs for all public use-cases | |||
| Resolved | Vgutierrez | T213737 Allow specifying a custom period of time before deploying a newly issued certificate |
Change 485594 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/certcentral@master] certcentral: Implement staging time
Change 485594 merged by jenkins-bot:
[operations/software/certcentral@master] certcentral: Implement staging time
Change 489988 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/certcentral@debian] certcentral: Implement staging time
Change 490006 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/certcentral@master] Release 0.9 This release includes the following changes: * Implement staging time * Rename certcentral to acme-chief
Change 490006 merged by jenkins-bot:
[operations/software/certcentral@master] Release 0.9 This release includes the following changes: * Implement staging time * Rename certcentral to acme-chief
Change 490011 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/certcentral@debian] Release 0.9 This release includes the following changes: * Implement staging time * Rename certcentral to acme-chief
Change 489988 merged by jenkins-bot:
[operations/software/certcentral@debian] certcentral: Implement staging time
Change 490011 merged by jenkins-bot:
[operations/software/certcentral@debian] Release 0.9 This release includes the following changes: * Implement staging time * Rename certcentral to acme-chief
Mentioned in SAL (#wikimedia-operations) [2019-02-12T13:39:41Z] <vgutierrez> uploaded acme-chief 0.9 to apt.wikimedia.org (stretch) - T207389 T213737
Is this resolved now? Also, duplicate of T204997: certcentral: delay deployment of renewed certs to wait out skewed client clocks ?