Background
On 2025-03-17, we enabled dual certificate support (RSA + ECDSA) and enforced server-preferred TLS cipher suite ordering on both Exim and Apache for lists.wikimedia.org.
Here is the current TLS usage data from Exim (as of 2025-06-27), considering only inbound (<=) connections:
# TLS version usage $ zgrep -oE ".+<=.*(X=TLS[A-Z_0-9\.:]+)" /var/log/exim4/mainlog* \ | grep -o "X=TLS.*" \ | cut -f1 -d':' \ | sort | uniq -c 16 X=TLS1.0 1241 X=TLS1.2 13882 X=TLS1.3 # Cipher suite usage $ zgrep -oE ".+<=.*(X=TLS[A-Z_0-9\.:]+)" /var/log/exim4/mainlog* \ | grep -o "X=TLS.*" \ | cut -f1-2 -d':' \ | sort | uniq -c | sort -rn 13883 X=TLS1.3:ECDHE_SECP256R1__ECDSA_SECP256R1_SHA256__AES_256_GCM 873 X=TLS1.2:ECDHE_SECP256R1__ECDSA_SHA512__AES_256_GCM 230 X=TLS1.2:ECDHE_SECP256R1__ECDSA_SHA256__AES_256_GCM 130 X=TLS1.2:ECDHE_SECP256R1__RSA_SHA512__AES_256_GCM 16 X=TLS1.0:ECDHE_SECP256R1__ECDSA_SHA1__AES_256_CBC__SHA1 5 X=TLS1.2:ECDHE_SECP256R1__ECDSA_SHA256__AES_128_GCM 3 X=TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM
As expected, ECDSA certificates dominate, but there's still measurable usage of the RSA variant.
Next steps
- Trim accepted cipher suites to match HTTPS configuration standards
- Disable TLSv1.0 and TLSv1.1
- Review RSA certificate usage:
- Plan deprecation if client compatibility permits