Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sectigo AddTrust External CA Root Expiring May 30, 2020

support.sectigo.com

Post reply on HN
Print view View original

1–8 of 8 posts

Re: Sectigo AddTrust External CA Root Expiring May 30, 2020

#2

Post by hayzeus »

So we've done some testing, and it looks like this certificate needs to be removed from the root ca bundles of Ubuntu 16.04 and earlier, as well as Debian 9 and earlier, even if these hosts are otherwise up do date (including the root certificate bundle). We've gone head and rolled out a fix, but I guess consider this a heads up.

I mean, Debian 9 isn't that old.

Its relatively easy to test -- create a host using an older, affected distribution, set the time forward to, say, 6/1/2020, and run 'curl https://crt.sh/' . You should get a ceritifcate expired error

Re: Sectigo AddTrust External CA Root Expiring May 30, 2020

#3

Post by detaro »

hayzeus wrote: post #2

So we've done some testing, and it looks like this certificate needs to be removed from the root ca bundles of Ubuntu 16.04 and earlier, as well as Debian 9 and earlier, even if these hosts are otherwise up do date (including the root certificate bundle). We've gone head and rolled out a fix, but I guess consider this a heads up. I mean, Debian 9 isn't that old. Its relatively easy to test -- create a host using an o…

Why does it need to be removed? Shouldn't it just cleanly expire and be ignored?

Re: Sectigo AddTrust External CA Root Expiring May 30, 2020

#4

Post by hayzeus »

detaro wrote: post #3
hayzeus wrote: post #2

So we've done some testing, and it looks like this certificate needs to be removed from the root ca bundles of Ubuntu 16.04 and earlier, as well as Debian 9 and earlier, even if these hosts are otherwise up do date (including the root certificate bundle). We've gone head and rolled out a fix, but I guess consider this a heads up. I mean, Debian 9 isn't that old. Its relatively easy to test -- create a host using an o…

Why does it need to be removed? Shouldn't it just cleanly expire and be ignored?

Yes -- but on older linux distributions curl, etc continue to try to use it

Re: Sectigo AddTrust External CA Root Expiring May 30, 2020

#5

Post by detaro »

hayzeus wrote: post #4
detaro wrote: post #3

Earlier quoted context omitted.

Why does it need to be removed? Shouldn't it just cleanly expire and be ignored?

Yes -- but on older linux distributions curl, etc continue to try to use it

Interesting, I would've expected them to ignore an expired cert in the chain if there is also a still valid one.
Post reply on HN