Page MenuHomePhabricator
Create Task
Maniphest T286377

LetsEncrypt cert expiration warning for some ncredir names
Closed, ResolvedPublic
Actions

Description

We got an email on noc@ from LetsEncrypt warning that certs for the names listed below will expire at 2021-07-19 14:01 UTC -- that's ten days from this task, nineteen days from their warning. That's closer than we usually let these get to expiring, as I understand it.

The list of names exactly matches non-canonical-redirect-2 in hieradata/common.yaml.

Marking this high priority because expiration will be a week from the end of the WMF holiday; traffic folks, feel free to downgrade.

The email subject was Let's Encrypt certificate expiration notice for domain "*.wikimania.asia" (and 37 more), received at 2021-06-29 14:09 UTC. Affected names:

*.wikimania.asia
*.wikimania.com
*.wikimania.org
*.wikimedia.com
*.wikimedia.community
*.wikimedia.jp.net
*.wikimedia.lt
*.wikimedia.us
*.wikimediacommons.co.uk
*.wikimediacommons.info
*.wikimediacommons.jp.net
*.wikimediacommons.mobi
*.wikimediacommons.net
*.wikimediacommons.org
*.wikimediafoundation.com
*.wikimediafoundation.info
*.wikimediafoundation.net
*.wikinews.com
*.wikinews.de
wikimania.asia
wikimania.com
wikimania.org
wikimedia.com
wikimedia.community
wikimedia.jp.net
wikimedia.lt
wikimedia.us
wikimediacommons.co.uk
wikimediacommons.info
wikimediacommons.jp.net
wikimediacommons.mobi
wikimediacommons.net
wikimediacommons.org
wikimediafoundation.com
wikimediafoundation.info
wikimediafoundation.net
wikinews.com
wikinews.de

Details

SubjectRepoBranchLines +/-
acme-chief: Drop wikimedia.com related SNIsoperations/puppetproduction+0 -2
nc_redirects: Remove wikimedia.com ruleoperations/puppetproduction+0 -3
Customize query in gerrit

Related Objects

Event Timeline

RLazarus created this task.Jul 9 2021, 3:35 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 9 2021, 3:35 PM
RLazarus triaged this task as High priority.Jul 9 2021, 3:35 PM
Vgutierrez lowered the priority of this task from High to Medium.Jul 10 2021, 6:03 PM
Vgutierrez added a subscriber: BBlack.

non-canonical-redirect-2 has been successfully renewed on July 3rd with the exception of wikimedia.com and *.wikimedia.com. This is expected and caused by T281428. It looks like as part of that task @BBlack missed the clean-up of the acme-chief config.

root@acmechief1001:/var/lib/acme-chief/certs/non-canonical-redirect-2# openssl x509 -noout -issuer -dates -in /var/lib/acme-chief/certs/non-canonical-redirect-2/live/rsa-2048.crt
issuer=C = US, O = Let's Encrypt, CN = R3
notBefore=Jul  3 16:00:50 2021 GMT
notAfter=Oct  1 16:00:49 2021 GMT

acme-chief continued to issue the certificate cause the non-canonical-redirect certs are configured with the flag skip_invalid_snis: true

root@acmechief1001:/var/lib/acme-chief/certs/non-canonical-redirect-2# openssl x509 -noout -text -in /var/lib/acme-chief/certs/non-canonical-redirect-2/live/rsa-2048.crt |grep DNS: |sed s/DNS://g |sed 's/, /\n/g'
                *.wikimania.asia
*.wikimania.com
*.wikimania.org
*.wikimedia.community
*.wikimedia.jp.net
*.wikimedia.lt
*.wikimedia.us
*.wikimediacommons.co.uk
*.wikimediacommons.info
*.wikimediacommons.jp.net
*.wikimediacommons.mobi
*.wikimediacommons.net
*.wikimediacommons.org
*.wikimediafoundation.com
*.wikimediafoundation.info
*.wikimediafoundation.net
*.wikinews.com
*.wikinews.de
wikimania.asia
wikimania.com
wikimania.org
wikimedia.community
wikimedia.jp.net
wikimedia.lt
wikimedia.us
wikimediacommons.co.uk
wikimediacommons.info
wikimediacommons.jp.net
wikimediacommons.mobi
wikimediacommons.net
wikimediacommons.org
wikimediafoundation.com
wikimediafoundation.info
wikimediafoundation.net
wikinews.com
wikinews.de
gerritbot added a comment.Jul 10 2021, 6:12 PM

Change 703910 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] nc_redirects: Remove wikimedia.com rule

https://gerrit.wikimedia.org/r/703910

gerritbot added a project: Patch-For-Review.Jul 10 2021, 6:12 PM

Change 703911 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] acme-chief: Drop wikimedia.com related SNIs

https://gerrit.wikimedia.org/r/703911

Vgutierrez added a comment.Jul 10 2021, 6:15 PM

I'll merge https://gerrit.wikimedia.org/r/703910 and https://gerrit.wikimedia.org/r/703911 on Monday to properly clean-up wikimedia.com from ncredir rules and acme-chief configuration, thanks for filling the task @RLazarus

gerritbot added a comment.Jul 12 2021, 8:19 AM

Change 703910 merged by Vgutierrez:

[operations/puppet@production] nc_redirects: Remove wikimedia.com rule

https://gerrit.wikimedia.org/r/703910

gerritbot added a comment.Jul 12 2021, 8:36 AM

Change 703911 merged by Vgutierrez:

[operations/puppet@production] acme-chief: Drop wikimedia.com related SNIs

https://gerrit.wikimedia.org/r/703911

Vgutierrez closed this task as Resolved.Jul 12 2021, 8:40 AM
Vgutierrez claimed this task.
Maintenance_bot removed a project: Patch-For-Review.Jul 12 2021, 9:10 AM
RLazarus awarded a token.Jul 12 2021, 2:03 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL