As part of moving Gerrit behind the CDN gerrit is now addressed by ATS under the new gerrit.discovery.wmnet name which points to one of the backend server names.

Gerrit servers have 2 public IPs, one host name and one service name. We have allowed incoming https connections to both of them in the firewall now.

acme_chief/Letsencrypt provides the certificates for our public service names in .wikimedia.org but naturally it can't issue a cert for an internal .wmnet name.

Therefore we needed a work-around which was to disable TLS host validation.

This task is to find a different solution for this certificate issue which allows us to revert https://gerrit.wikimedia.org/r/c/operations/puppet/+/1215684 eventually.

quoting the comment from its commit message:

Easiest might be another reverse proxy on a different port on the gerrit hosts, serving a different cert (but then proxied onwards to Apache).