The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

TLS in the caching cluster is terminated by nginx. It performs the following roles:

TLS terminator
HTTP/2 terminator
Forward TLS & HTTP/2 metrics to varnish

TLS termination

TLS requirements for canonical domains and hence for the caching cluster are described at HTTPS. Puppetization happens in profile::cache::ssl::unified and more specifically in tlsproxy::localssl. The usual TLS configuration parameters (ciphersuites enabled and their preference order, DH parameters and optionally HSTS) happens in the puppet function ssl_ciphersuite.

HSTS

HSTS header injection is performed by our varnish frontend layer in wikimedia-frontend.vcl.erb and it looks like this:

strict-transport-security: max-age=106384710; includeSubDomains; preload

OCSP stapling

OCSP stapling is performed externally to nginx. So nginx just sends a prefetched OCSP stapling response that's obtained every 12 hours using the nginx configuration directive ssl_stapling_file and a custom patch to support dual-cert setups with prefetched OCSP stapling responses. A good post about why this is being done like this can be found in APNIC's blog.

OCSP stapling prefetching is performed by update-ocsp and it's puppetization lives in sslcert::ocsp::conf which of course is invoked in the already mentioned profile::cache::ssl::unified