Page MenuHomePhabricator
Create Task
Maniphest T220359

Benefit from acme-chief features in acme-chief clients
Open, Stalled, MediumPublic
Actions

Description

Currently acme-chief offers some features that are being ignored by its clients:

  • dual-cert set-up: all acme-chief clients that support dual-cert stack are currently using ECDSA+RSA certificates
  • OCSP stapling support (T232988)

Currently (almost) every acme-chief client should be able to serve a dual-cert setup but all of them are using RSA-2048 certificates. (Take into account that our TLS traffic is mostly using ECDSA certificates).

Regarding OCSP stapling, at least nginx based acme-chief clients should be able to use it.

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
dumps: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+2 -0
install_server: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+2 -0
gerrit: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+3 -0
archiva: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+8 -4
tendril: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+3 -0
mirrors: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+2 -0
librenms: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+3 -0
netbox: Offer an ECDSA certificate along with the RSA oneVgutierrezoperations/puppetproduction+3 -0
Customize query in gerrit

Related Objects

Event Timeline

Vgutierrez created this task.Apr 8 2019, 10:50 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 8 2019, 10:50 AM
Vgutierrez triaged this task as Medium priority.Apr 8 2019, 10:51 AM
Vgutierrez moved this task from Backlog to TLS on the Traffic board.
gerritbot added a comment.Apr 8 2019, 11:11 AM

Change 502195 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] netbox: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502195

gerritbot added a project: Patch-For-Review.Apr 8 2019, 11:11 AM
gerritbot added a comment.Apr 8 2019, 12:11 PM

Change 502195 merged by Vgutierrez:
[operations/puppet@production] netbox: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502195

gerritbot added a comment.Apr 8 2019, 12:28 PM

Change 502205 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] librenms: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502205

gerritbot added a comment.Apr 8 2019, 2:39 PM

Change 502205 merged by Vgutierrez:
[operations/puppet@production] librenms: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502205

gerritbot added a comment.Apr 8 2019, 3:43 PM

Change 502260 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] mirrors: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502260

gerritbot added a comment.Apr 8 2019, 3:45 PM

Change 502263 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] tendril: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502263

gerritbot added a comment.Apr 9 2019, 7:45 AM

Change 502260 merged by Vgutierrez:
[operations/puppet@production] mirrors: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502260

gerritbot added a comment.Apr 9 2019, 7:52 AM

Change 502263 merged by Vgutierrez:
[operations/puppet@production] tendril: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502263

gerritbot added a comment.Apr 9 2019, 2:32 PM

Change 502503 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] archiva: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502503

gerritbot added a comment.Apr 9 2019, 2:51 PM

Change 502506 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] gerrit: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502506

gerritbot added a comment.Apr 9 2019, 2:56 PM

Change 502509 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] install_server: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502509

gerritbot added a comment.Apr 9 2019, 2:59 PM

Change 502513 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] dumps: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502513

gerritbot added a comment.Apr 10 2019, 7:45 AM

Change 502503 merged by Vgutierrez:
[operations/puppet@production] archiva: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502503

gerritbot added a comment.Apr 10 2019, 8:05 AM

Change 502506 merged by Vgutierrez:
[operations/puppet@production] gerrit: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502506

gerritbot added a comment.Apr 10 2019, 8:10 AM

Change 502509 merged by Vgutierrez:
[operations/puppet@production] install_server: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502509

gerritbot added a comment.Apr 10 2019, 8:16 AM

Change 502513 merged by Vgutierrez:
[operations/puppet@production] dumps: Offer an ECDSA certificate along with the RSA one

https://gerrit.wikimedia.org/r/502513

Vgutierrez changed the task status from Open to Stalled.Apr 10 2019, 8:27 AM
Vgutierrez removed a project: Patch-For-Review.
Vgutierrez updated the task description. (Show Details)
Krenair updated the task description. (Show Details)Sep 21 2019, 5:26 PM
BBlack edited projects, added: Traffic-Icebox; removed: Traffic.Sep 1 2021, 11:21 PM
BBlack subscribed.

The swap of Traffic for Traffic-Icebox in this ticket's set of tags was based on a bulk action for all such tickets that haven't been updated in 6 months or more. This does not imply any human judgement about the validity or importance of the task, and is simply the first step in a larger task cleanup effort. Further manual triage and/or requests for updates will happen this month for all such tickets. For more detail, have a look at the extended explanation on the main page of Traffic-Icebox . Thank you!

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits