Set up TLS dual stack for mx-in[12]001.wikimedia.org
Closed, InvalidPublic
Actions

Assigned To

None

Authored By

	Vgutierrez
	Jun 27 2025, 9:28 AM

Description

It looks like we missed mx-in servers on T375569. As seen by TLS usage stats in lists.wm.o on T398018, enabling ECDSA certificates is feasible and has a good adoption from clients.

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	exim: Start using ECDSA certificate on mx-in	operations/puppet	production	+2 -2

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	BCornwall	T370837 Remove RSA certificates and use only ECDSA certificates
Resolved	BCornwall	T375569 Remove RSA certificates from puppet
Invalid	None	T398019 Set up TLS dual stack for mx-in[12]001.wikimedia.org

Event Timeline

Vgutierrez created this task.Jun 27 2025, 9:28 AM

Vgutierrez mentioned this in T398020: Stop issuing RSA certificates.

Change #1164397 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] exim: Start using ECDSA certificate on mx-in

https://gerrit.wikimedia.org/r/1164397

gerritbot added a project: Patch-For-Review.Jun 27 2025, 9:34 AM

I was tricked by the old exim4 puppetization, mx-in is currently using postfix and dual stack

Change #1164397 abandoned by Vgutierrez: