Change Details

The SSL-config of the OTRS (ticket.wikimedia.org) is outdated. No PFS, weak key-options and the MAC and the MAC of the certificate still use SHA1 (the later is not that urgent and can be fixed during the next cert-renewing). Because the OTRS contains sensitive data, a SSL-setup that is at least as secure as the SSL-config for Wikipedia is needed. Maybe it would be a good idea to config DNSSEC for that domain too (and if you REALLY in the mode: DANE too).

The SSL-config of the OTRS (ticket.wikimedia.org) is outdated. No PFS, weak key-options and the MAC of the certificate still use SHA1 (the later is not that urgent and can be fixed during the next cert-renewing). Because the OTRS contains sensitive data, a SSL-setup that is at least as secure as the SSL-config for Wikipedia is needed. Maybe it would be a good idea to config DNSSEC for that domain too (and if you REALLY in the mode: DANE too).

The SSL-config of the OTRS (ticket.wikimedia.org) is outdated. No PFS, weak key-options and the MAC and the MAC of the certificate still use SHA1 (the later is not that urgent and can be fixed during the next cert-renewing). Because the OTRS contains sensitive data, a SSL-setup that is at least as secure as the SSL-config for Wikipedia is needed. Maybe it would be a good idea to config DNSSEC for that domain too (and if you REALLY in the mode: DANE too).