Right now we are currently using the unified certificate on the upload cluster when effectively we only need two SANs (upload.w.o and maps.w.o). I'm guessing this comes from the times where we used commercial CAs in the CDN. This could end "soon" and we probably could benefit from shipping a single cert with both upload.w.o and maps.w.o or two certificates.
Potential benefits:
- Decrease the exposure of our unified cert
- Save one RTT per TLS handshake on the upload cluster. (packets needed to perform a TLS 1.3 handshake decreases on a 12.5%: from 16 to 14)
In terms of traffic we would be saving ~700 bytes per TLSv1.3 connection (rough estimate using en.wikipedia.org VS www.wikiworkshop.org ServerHello data):
$ openssl s_client -msg -servername www.wikiworkshop.org -connect text-lb.eqiad.wikimedia.org:443 2>/dev/null </dev/null |grep Certificate <<< TLS 1.3, Handshake [length 0839], Certificate $ openssl s_client -msg -servername en.wikipedia.org -connect text-lb.eqiad.wikimedia.org:443 2>/dev/null </dev/null |grep Certificate <<< TLS 1.3, Handshake [length 0af4], Certificate
some napkin math calculations shows that we would save ~456 GB of data per day assuming ~700 millions of connections per day to the upload cluster
