Change Details

For performance reasons, we should switch to ECDSA Hybrid (= signed by an RSA CA) certificates for our projects. This will bring us performance benefits, both in terms of RTTs and CPU usage. Since we now do SNI and the set of browsers that support SNI & ECDSA is the same (which we should double-check), we can safely do this with a wide UA impact and without hurting any non-compatible UAs, as long as we keep our fallback "unified" certificate RSA. This is blocked on availability of those certificates, as most CAs do not sell them yet. Our new CA provider, GlobalSign, had previously gave us a Q1 2015 ETA for these, right before we picked them. I asked our representative last Tuesday (and again today) to confirm that they're still on track for this.