CA Root expired on 30 May 2020
support.sectigo.com
CA Root expired on 30 May 2020
1–10 of 154 posts
Re: CA Root expired on 30 May 2020
#2I have never really wanted to go "serverless" until today.
TIL that I can buy a cert that expires in a year that is signed by a root certificate that expires sooner. Still not sure WHY this is the case, but this is definitely the case.
Re: CA Root expired on 30 May 2020
#3Any predictions how much the usage of CURLOPT_SSL_VERIFYPEER, false will increase in the next 7 days?
Re: CA Root expired on 30 May 2020
#4Great thread by Ryan Sleevi tracking the many (and growing) reports of issues caused by this root expiring: https://twitter.com/sleevi_/status/1266647545675210753
Top offender so far seems to be GnuTLS.
Re: CA Root expired on 30 May 2020
#5This issue is largely cause by people still stuffing old root certificates in their certificate chains, and serving that to their users.
As a general rule of thumb:
1) You don't need to add root certificates to your certificate chain
2) You especially don't need to add expired root certificates to the chain
For additional context and the ability to check using `openssl` what certificates you should modify in your chain, I found this post useful: https://ohdear.app/blog/resolving-the-addtrust-external-ca-r...
Re: CA Root expired on 30 May 2020
#6DataDog failed this morning because of root CA issue.[0] Was a fun Saturday morning with 5000 alarms blowing up my phone.
Re: CA Root expired on 30 May 2020
#7I have never really wanted to go "serverless" until today. TIL that I can buy a cert that expires in a year that is signed by a root certificate that expires sooner. Still not sure WHY this is the case, but this is definitely the case.
As far as I understand your certificate is still valid but you need to remove the intermediate certificate from your bundle. That was the case for me anyway.
Re: CA Root expired on 30 May 2020
#8This issue is largely cause by people still stuffing old root certificates in their certificate chains, and serving that to their users. As a general rule of thumb: 1) You don't need to add root certificates to your certificate chain 2) You especially don't need to add expired root certificates to the chain For additional context and the ability to check using `openssl` what certificates you should modify in your cha…
Any guess at what percentage is this versus the case where these certs are cross-signed with a newer root but older clients with outdated bundles do not trust the newer root?
(At Cronitor, we saw about a 10% drop in traffic, presumably from those with outdated bundles)
Re: CA Root expired on 30 May 2020
#9I have never really wanted to go "serverless" until today. TIL that I can buy a cert that expires in a year that is signed by a root certificate that expires sooner. Still not sure WHY this is the case, but this is definitely the case.
As far as I understand your certificate is still valid but you need to remove the intermediate certificate from your bundle. That was the case for me anyway.
If your traffic comes from a browser you are fine with this but if you're coming from e.g. Curl you will find that you need to include an intermediate chain.
(The reason for the difference being that browser stay up to date, many old client systems do not.)
We ended up getting a new cert from a different provider.
Re: CA Root expired on 30 May 2020
#10This issue is largely cause by people still stuffing old root certificates in their certificate chains, and serving that to their users. As a general rule of thumb: 1) You don't need to add root certificates to your certificate chain 2) You especially don't need to add expired root certificates to the chain For additional context and the ability to check using `openssl` what certificates you should modify in your cha…
Any guess at what percentage is this versus the case where these certs are cross-signed with a newer root but older clients with outdated bundles do not trust the newer root? (At Cronitor, we saw about a 10% drop in traffic, presumably from those with outdated bundles)
Hard to say, as we don't have any insights into the client-side. But we can say that only ~2% of our clients had expiring root certificates in their chain in the last few weeks, so it's definitely a minority.
Since you don't control the clients in anyway, it might be that there are clients that haven't updated their local certificate stores in ages and don't yet trust the new root certificates.