After some puppet work:

The infrastructure is the following:

• Certificates are generated on the puppet master using the certbot client. This is configured in the profile::letsencrypt puppet class.
  • The list of certificates is in the letsencrypt::certificates hiera variable
  • The (DNS) challenge is done via a python script using Gandi's LiveDNS API (profile::letsencrypt::gandi_livedns_hook class)
  • Renewal is done through the systemd timer built into the Debian package
  • Certificates in /etc/letsencrypt/live are exported by a certbot deploy_hook into /var/lib/puppet/letsencrypt_exports, and made readable by the puppet master user
• Certificates are pulled on the servers via the profile::letsencrypt::certificate puppet defined type (which will replace the previous profile::ssl class)
  • This retrieves the certs from the puppet master into the files pointed at by the profile::letsencrypt::certificate_paths function

This means that the renewed certificates will only reach the servers when puppet is run on them.

This also means that when adding a new vhost to a server, we need to:

1. update the puppet config
2. run puppet on pergamon to generate the new cert
3. run puppet on the appropriate server
4. run puppet on pergamon again to pick up the monitoring-related exported resources

These multiple interlocked steps make me feel that we should start cronning puppet on servers rather than running it by hand.

Now that the Let's Encrypt scaffolding is in place, we should be able to replace the wildcard certificates gradually.

Finally, to solve the www.softwareheritage.org certificate question, I've quickly looked at the Gandi APIs, but I couldn't find the API to upload TLS certificates to simple hosting instances. I haven't looked too hard yet, I'm sure it's doable.