5 days before the Let’s Encrypt’s Root Certificate is expiring!
Posted by jpluimers on 2021/09/24
Only 5 days left to take a close look at both your web-clients (including back-end clients!) and servers to prevent potential Let’s Encrypt mayhem.
Last week, [Wayback] Scott Helme published about [Wayback/Archive.is] Let’s Encrypt’s Root Certificate is expiring!
Let’s Encrypt has done loads of work over the past lustrum to prevent trouble like cross-signing, issuing the successor certificates, and more.
The problem is that people like you and me have refrained from keeping their clients and servers up-to-date, so some security issues will occur. Hopefully they are limited to non-functioning communication and not leaking of data.
It is about this DST Root CA X3 certificate, used by the vast majority of Let’s Encrypt certificates, [Wayback/Archive.is] Certificate Checker: CN=DST Root CA X3, O=Digital Signature Trust Co.:
DST Root CA X3 Certificate Trusted anchor certificate Subject DN CN=DST Root CA X3, O=Digital Signature Trust Co. Issuer DN CN=DST Root CA X3, O=Digital Signature Trust Co. Serial Number 44AFB080D6A327BA893039862EF8406BValid to Key RSAPublicKey (2048 bit) SHA1 Hash DAC9024F54D8F6DF94935FB1732638CA6AD77C13MD5 Hash 410352DC0FF7501B16F0028EBA6F45C5SKI C4A7B1A47B2C71FADBE14B9075FFC41560858910AKI
Quoting Scott, these clients likely will fail, so need attention:
- OpenSSL <= 1.0.2
- Windows < XP SP3
- macOS < 10.12.1
- iOS < 10 (iPhone 5 is the lowest model that can get to iOS 10)
- Android < 7.1.1 (but >= 2.3.6 will work if served ISRG Root X1 cross-sign)
- Mozilla Firefox < 50
- Ubuntu < 16.04
- Debian < 8
- Java 8 < 8u141
- Java 7 < 7u151
- NSS < 3.26
- Amazon FireOS (Silk Browser)
On the server side, you can help Android devices by using a Let’s Encrypt certificate that is cross-signed with the ISRG Root X1 certificate [Wayback/Archive.is] Certificate Checker: CN=ISRG Root X1, O=Internet Security Research Group, C=US:
ISRG Root X1 Certificate Subject DN CN=ISRG Root X1, O=Internet Security Research Group, C=US Issuer DN CN=DST Root CA X3, O=Digital Signature Trust Co. Serial Number 4001772137D4E942B8EE76AA3C640AB7Valid to Key RSAPublicKey (4096 bit) SHA1 Hash 933C6DDEE95C9C41A40F9F50493D82BE03AD87BFMD5 Hash C1E1FF07F9F688498274D1A18053EABFSKI 79B459E67BB6E5E40173800888C81A58F6E99B6EAKI C4A7B1A47B2C71FADBE14B9075FFC41560858910
Via [Archive.is] Scott Helme on Twitter: “There are only 10 days left until the Let’s Encrypt root certificate expires and there are still questions over what the impact will be! Full details here: …” which links to the above article showing a nice graph of the current Let’s Encrtypt root certificate setup:
–jeroen
The Wiert Corner - irregular stream of stuff 
Leave a comment