Migrate TLS for jQuery CDN to ACME (deadline: 30 Nov 2026)
@Krinkle ci sta già lavorando.
Dal 27/5/2026.
Valutazione
Questa issue non è ancora stata valutata.
Descrizione
What
Following up from this year's renewal, we should migrate to fully automatic certificates (ACME, e.g. Let's Encrypt and such).
Why
https://github.com/jquery/infrastructure-puppet/issues/85:
[…] This year is going to be different because the CAB Forum approved a decision past year to gradually reduce the maximum lifetime of all TLS certificates to 47 days by 2029.
[…] Sectigo, has already recently lowered the maximum from 356 to 200 days and it'll reduce to 100 days next year. (see Sectigo April 2025 press release).
So we could certainly renew this the usual way one more time, with 200 days, but by next year we should really be on automation […]
When
The current cert expires on 4 Dec 2026, so let's aim to get this live by 30 Nov 2026.
How
- Experiment with Fastly-managed TLS using Certainly.
- Experiment with Fastly-managed TLS using GlobalSign.
- Determine how far back their roots are trusted by old devices, and how this compares to Sectigo.
- Decide on a reliable testing setup (i.e. Fastly cluster configuration and domain).
- Observe renewal cycle: How long before expiry does it renew?
- Observe renewal cycle: How long after minting/issuing new certs are they activated?
- Pilot: Gradually roll out on jQuery domains served via Fastly (except code.jquery.com)
- Converge on the best setup and switch all piloted services to the preferred setup.
- Switch code.jquery.com by end of November 2026.
/cc @ryanaslett @timmywil
- Lingua principale
- Puppet
- Stelle
- 12
- Fork
- 9
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Preparare l'ambiente
- Nessun Dockerfile né file Docker Compose
- Nessun modello di pull request
- Leggi la guida per i contributori
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di jquery/infrastructure-puppet
-
Service: Search
Difficoltà 5/5 Più di una settimana Idoneità per principianti 35/100
-
Should we disable TLS 1.0/1.1?Forse di nuovo libera @Krinkle l’ha presa 278 giorni fa e non c’è nessuna pull request aperta. Apertasecurity Service: Doc sites Type: Enhancement
jquery/infrastructure-puppet#79 · 10 commenti · 1 assegnatario ·
-
Service: Puppet Type: Problem
Difficoltà 4/5 3-5 giorni Idoneità per principianti 35/100
-
Re-enable GitHub backupsApertaService: Backups Type: Enhancement
Difficoltà 4/5 3-5 giorni Idoneità per principianti 25/100
jquery/infrastructure-puppet#9 · 2 commenti ·
-
Service: Doc sites Type: Enhancement
Difficoltà 4/5 3-5 giorni Idoneità per principianti 28/100