12:09 p.m.
Vi har fått en del frågor om kedjecertifikaten, särskilt att några ser
ut att gå ut 2020-05-30. Jag har lagt till information om detta på
slutet av
https://wiki.sunet.se/display/TCS/SUNET+TCS+2020-+Information+for+administr…
och passat på att lägga till lite mer också:
What about the expiring certificates in the certificate chain?
Some of you may have noticed that the chain certificates we get from
Sectigo contains a certificate at the top with CN = AddTrust External CA
Root and an expiration on 2020-05-30. For an explanation of why this
should not cause problems for you, please see "Sectigo AddTrust External
CA Root Expiring May 30, 2020" on the Sectigo site.
You may also notice that the next level down in the chain is CN =
USERTrust RSA Certification Authority which also expires on 2020-05-30,
and that is the certificate that has signed the CN = GEANT OV RSA CA 4
certificate that in turn has signed the SSL certificate for your server.
That also seems bad, doesn't it? It turns out that certificate is there
to support the CN = AddTrust External CA Root "feature" and that there
is another version of CN = AddTrust External CA Root present in the root
store of the browsers (using the same key) which is valid until
2038-01-18, and that is the one that matters and makes the browser trust
the GEANT-branded CA certificate and therefore your server certificate.
The conclusion is that things will work after 2020-05-30 too.
Do we really need all those certificates in the chain?
No. You should be fine with only the GEANT-branded sub-CA certificate
(CN = GEANT OV RSA CA 4 or similar) configured as chain certificate in
your server.
Where can we check if our server sends the correct chain?
We recommend Qualys SSL Server Test which tests this and and a lot of
other useful things (most of them related to you server configuration,
not the certificates as such). For the chain specifically, look at the
"Chain issues" heading where you want to see "None" (if you have
trimmed
the unnecessary certificates from the chain) or "Contains anchor" (if
you have kept the full set).
--
Kent Engström, SUNET TCS
kent at nsc.liu.se, +46 13 28 4444