The Wikimedia Foundation uses HTTPS to protect users from eavesdropping and tampering of Wikimedia project pages [1]. As time passes, security protocols gain advancements while weaknesses hamper established protocols. WMF monitors such developments and adjusts ciphers/protocols to provide a secure and performant browsing experience.
Wikimedia projects serve RSA and ECDSA certificates; RSA certificates will be removed soon. Wikimedia projects are to serve only ECDSA certificates going forward [2]. RSA certificate usage comprises a fraction of traffic (~0.1%). Additionally, RSA continues weakening in security and increases our cost/overhead of certificate issuance (We pay twice for certificates: Once for ECDSA and once for RSA).
In the distant future, WMF also intends on deprecating TLS 1.2 in favor of TLS 1.3 [3]. TLS 1.3 provides security and performance improvements and already comprises the majority of Wikimedia project traffic (TLS 1.2 traffic accounts for less than 4 percent of traffic to Wikimedia sites). Note that this deprecation is not scheduled anytime soon! We merely want to start coordinating with community members and projects to begin the transition. This mail only serves as a preliminary announcement of intent to eventually deprecate TLS 1.2, not as an official deprecation warning.
[1] https://wikitech.wikimedia.org/wiki/HTTPS [2] https://phabricator.wikimedia.org/T370837 [3] https://phabricator.wikimedia.org/T367821
On Wed Aug 21, 2024 at 10:15 AM PDT, Brett Cornwall wrote:
The Wikimedia Foundation uses HTTPS to protect users from eavesdropping and tampering of Wikimedia project pages [1]. As time passes, security protocols gain advancements while weaknesses hamper established protocols. WMF monitors such developments and adjusts ciphers/protocols to provide a secure and performant browsing experience.
Wikimedia projects serve RSA and ECDSA certificates; RSA certificates will be removed soon. Wikimedia projects are to serve only ECDSA certificates going forward [2]. RSA certificate usage comprises a fraction of traffic (~0.1%). Additionally, RSA continues weakening in security and increases our cost/overhead of certificate issuance (We pay twice for certificates: Once for ECDSA and once for RSA).
[...]
Over the last month we served occasional warning pages to browsers connecting via the RSA certificates. We increased the frequency of such warnings over time; Today, all affected users will be receiving that error page. Next Monday, 2024-12-02, the RSA certificates will be removed and clients that do not support ECDSA will experience connectivity issues.
On Mon Nov 25, 2024 at 6:05 PM PST, Brett Cornwall wrote:
On Wed Aug 21, 2024 at 10:15 AM PDT, Brett Cornwall wrote:
The Wikimedia Foundation uses HTTPS to protect users from eavesdropping and tampering of Wikimedia project pages [1]. As time passes, security protocols gain advancements while weaknesses hamper established protocols. WMF monitors such developments and adjusts ciphers/protocols to provide a secure and performant browsing experience.
Wikimedia projects serve RSA and ECDSA certificates; RSA certificates will be removed soon. Wikimedia projects are to serve only ECDSA certificates going forward [2]. RSA certificate usage comprises a fraction of traffic (~0.1%). Additionally, RSA continues weakening in security and increases our cost/overhead of certificate issuance (We pay twice for certificates: Once for ECDSA and once for RSA).
[...]
Over the last month we served occasional warning pages to browsers connecting via the RSA certificates. We increased the frequency of such warnings over time; Today, all affected users will be receiving that error page. Next Monday, 2024-12-02, the RSA certificates will be removed and clients that do not support ECDSA will experience connectivity issues.
Removal was scheduled for today but we're going to move it to tomorrow for timing purposes. Thanks for your patience!
On Mon Dec 2, 2024 at 1:16 PM PST, Brett Cornwall wrote:
On Mon Nov 25, 2024 at 6:05 PM PST, Brett Cornwall wrote:
On Wed Aug 21, 2024 at 10:15 AM PDT, Brett Cornwall wrote:
The Wikimedia Foundation uses HTTPS to protect users from eavesdropping and tampering of Wikimedia project pages [1]. As time passes, security protocols gain advancements while weaknesses hamper established protocols. WMF monitors such developments and adjusts ciphers/protocols to provide a secure and performant browsing experience.
Wikimedia projects serve RSA and ECDSA certificates; RSA certificates will be removed soon. Wikimedia projects are to serve only ECDSA certificates going forward [2]. RSA certificate usage comprises a fraction of traffic (~0.1%). Additionally, RSA continues weakening in security and increases our cost/overhead of certificate issuance (We pay twice for certificates: Once for ECDSA and once for RSA).
[...]
Over the last month we served occasional warning pages to browsers connecting via the RSA certificates. We increased the frequency of such warnings over time; Today, all affected users will be receiving that error page. Next Monday, 2024-12-02, the RSA certificates will be removed and clients that do not support ECDSA will experience connectivity issues.
Removal was scheduled for today but we're going to move it to tomorrow for timing purposes. Thanks for your patience!
As of this hour, RSA certificate support has been removed.
wikitech-l@lists.wikimedia.org