Change Details

In the process of trying to document a our [[ https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption | SSL configuration ]] I have come across a few inconsistencies which would be good to tidy up. * logstash uses `base::expose_puppet_certs` but doesn't seem to use the certificates * a number of services using [[https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption#tlsproxy::localssl | tlsproxy::localssl]] should be migrated to `profile::tlsproxy::envoy` * Enable[[ https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption#Conf_tool | ssl validation ]] for conf tool, possibly add client auth * abstract stunnle4 used for rsync and migrate services to it Note: Audit is ongoing so this list will likely grow

In the process of trying to document a our [[ https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption | SSL configuration ]] I have come across a few inconsistencies which would be good to tidy up. * logstash uses `base::expose_puppet_certs` but doesn't seem to use the certificates * a number of services using [[https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption#tlsproxy::localssl | tlsproxy::localssl]] should be migrated to `profile::tlsproxy::envoy` * Enable [[ https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption#Conf_tool | ssl validation ]] for conf tool, possibly add client auth * abstract stunnle4 used for rsync and migrate services to it Note: Audit is ongoing so this list will likely grow

In the process of trying to document a our [[ https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption | SSL configuration ]] I have come across a few inconsistencies which would be good to tidy up. * logstash uses `base::expose_puppet_certs` but doesn't seem to use the certificates * a number of services using [[https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption#tlsproxy::localssl | tlsproxy::localssl]] should be migrated to `profile::tlsproxy::envoy` * Enable [[ https://wikitech.wikimedia.org/wiki/User:Jbond/Encryption#Conf_tool | ssl validation ]] for conf tool, possibly add client auth * abstract stunnle4 used for rsync and migrate services to it Note: Audit is ongoing so this list will likely grow