ping? it's also worth mentioning here that lists.wm.o right now is just offering RSA certificates and it should be migrated to a dual stack setup in preparation to drop RSA certs

What's the timeline for dropping RSA certs? Just so we know how urgent this is.

In T385067#10619441, @LSobanski wrote:

What's the timeline for dropping RSA certs? Just so we know how urgent this is.

we already dropped RSA certs in the CDN and other services (gerrit, phabricator, gitlab, icinga, grafana...) in January

@jhathaway any thoughts on this?

I think this should be fine, looking through the logs it appears that almost all clients are 1.2 or 1.3. The handful of 1.1 TLS connections used the ECDHE cert:

$ zgrep -E ' X=TLS1.1\S+ ' /var/log/exim4/mainlog* -ho | sort | uniq -c | sort -n | tail -n10                                                                                                            
      4  X=TLS1.1:ECDHE_SECP521R1__RSA_SHA1__AES_256_CBC__SHA1:256                         

In T385067#10620624, @jhathaway wrote:

I think this should be fine, looking through the logs it appears that almost all clients are 1.2 or 1.3. The handful of 1.1 TLS connections used the ECDHE cert:

$ zgrep -E ' X=TLS1.1\S+ ' /var/log/exim4/mainlog* -ho | sort | uniq -c | sort -n | tail -n10                                                                                                            
      4  X=TLS1.1:ECDHE_SECP521R1__RSA_SHA1__AES_256_CBC__SHA1:256                         

Please note that ECDHE there refers to Eliptic curve diffie hellman, the mechanism used to negoatiate a symmetric encryption key, but the certificate used is the RSA one, actually exim only go configure the RSA one:

vgutierrez@lists1004:/etc/exim4$ sudo fgrep acme exim4.conf
tls_certificate = /etc/acmecerts/lists/live/rsa-2048.chained.crt
tls_privatekey = /etc/acmecerts/lists/live/rsa-2048.key
vgutierrez@lists1004:/etc/exim4$

Please note that ECDHE there refers to Eliptic curve diffie hellman, the mechanism used to negoatiate a symmetric encryption key, but the certificate used is the RSA one, actually exim only go configure the RSA one:

ah, thanks @Vgutierrez that makes more sense

Change #1127066 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] lists: Offer RSA+ECDSA certificates on lists.wm.o

https://gerrit.wikimedia.org/r/1127066

I've submitted https://gerrit.wikimedia.org/r/1127066 as a first step to switch the web interface of lists.wikimedia.org to dual stack (RSA+ECDSA)

Change #1127933 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] exim: Use RSA+ECDSA certificates for lists

https://gerrit.wikimedia.org/r/1127933

Change #1127066 merged by Vgutierrez:

[operations/puppet@production] lists: Offer RSA+ECDSA certificates on lists.wm.o

https://gerrit.wikimedia.org/r/1127066

Change #1127933 merged by Vgutierrez:

[operations/puppet@production] exim: Use RSA+ECDSA certificates for lists

https://gerrit.wikimedia.org/r/1127933