SHA1 certificates still existing in our repo (as of 2015-05-29):
Intermediary SHA1 certificates (some of these will cease use when SHA1 certs are replaced, some won't, need to note which):
[ ] - (*.planet.wikimedia.org uses this) DigiCertHighAssuranceCA-3.crt
[ ] - RapidSSL_CA.crt - all rapidssl certs in sha256 appear to use RapidSSL_SHA256_CA_-_G3.crt. Once all sha1 rapidssl are replaced, this can be removed from the repo
[ ] - RapidSSL_CA_2 - all rapidssl certs in sha256 appear to use RapidSSL_SHA256_CA_-_G3.crt. Once all sha1 rapidssl are replaced, this can be removed from the repo
Standard SHA1 SSL Certs needing SHA256 re-issuance:
[ ] - ganglia.wikimedia.org.crt T100825
[ ] - git.wikimedia.org.crt T100827
[ ] - icinga.wikimedia.org.crt T100830
[ ] - ldap-mirror.wikimedia.org.crt
[ ] - librenms.wikimedia.org.crt T100831
[ ] - lists.wikimedia.org.crt T100832
[ ] - star.planet.wikimedia.org.crt
[ ] - star.wmflabs.crt : not a full fqdn, investigate
[ ] - star.wmflabs.org.crt : not issued via rapidssl, investiage
[x] - svn.wikimedia.org.crt - expired
[ ] - tendril.wikimedia.org.crt
[ ] - ticket.wikimedia.org.crt
[ ] - wikitech.wikimedia.org.crt T92709