hi everyone,
This LE root cert expiration have definitely caused some trouble for old installations. However we have just released an update to DA letsencrypt package to help servers support more old operating systems. Here is the story:
Up till now when LE certificates were used in DA we would serve the following certificate chain for clients connecting to DA or main web server:
Code:
# openssl s_client -connect example.net:2222
CONNECTED(00000003)
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
---
Certificate chain
0 s:/CN=example.net
i:/C=US/O=Let's Encrypt/CN=R3
1 s:/C=US/O=Let's Encrypt/CN=R3
i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
2 s:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
i:/O=Digital Signature Trust Co./CN=DST Root CA X3
...
The server would respond with three certificates 0 is the server cert, 1 is the LE intermediate cert and 3 is the LE root CA cert. On September 30th
DST Root CA X3 certificate have expired, but this should have not caused problems for
all moderately old systems that has
ISRG Root X1 CA certificate installed in the system.
For those systems having
ISRG Root X1 certificate served from the web server were optional, because those systems already trusts for
ISRG Root X1 to be reliable CA cert. However it was important for even older systems that trusted
DST Root CA X3 but were not aware about the
ISRG Root X1 existence.
After September 30th 2021 those extremely old systems can not connect to servers using LE certificates and even including
ISRG Root X1 in the server cert chain can not help them. Because
DST Root CA X3 is dead for everyone.
However expiration of the
DST Root CA X3 cert revealed another issue. Old software using old openssl versions refuses to connect to DA web server even when they do have
DST Root CA X3 trusted as root cert! This is because they see a reference to no longer valid
DST Root CA X3 certificate. This issue is not present in newer library version but still affects older (but not very old systems) where openssl is old but the system would otherwise trust
ISRG Root X1.
For those cases we have released an update to the `letsencrypt` package. The key change is that we no longer include the
ISRG Root X1 certificate in web server responses. The response from server with upgraded `letsencrypt` package would look like:
Code:
# openssl s_client -connect example.net:2222
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = example.net
verify return:1
---
Certificate chain
0 s:/CN=example.net
i:/C=US/O=Let's Encrypt/CN=R3
1 s:/C=US/O=Let's Encrypt/CN=R3
i:/C=US/O=Internet Security Research Group/CN=ISRG Root X1
...
We expect the system to have
ISRG Root X1 cert present in the system and only provide server certificate and intermediate certificate
R3. This allows older (but not extremely old) systems to connect to DA using LE certificates successfully which would otherwise fail if
DST Root CA X3 were present in the response.
To download the update please follow these steps:
Code:
# /usr/local/directadmin/custombuild/build update
# /usr/local/directadmin/custombuild/build letsencrypt
# /usr/local/directadmin/scripts/letsencrypt.sh request your.server.name.example.net
Essentially these steps will:
* Update custombuild installation to know about new package versions
* Download latest letsencrypt package (version 2.0.23)
* Re-issue your main server certificate (and omit
ISRG Root X1 in the chain)
TL;DR
Upgrading
letsencrypt v2.0.23 package via the
custombuild can allow some moderately old systems to connect to DA which currently fails to do so. New systems works fine with or without this upgrade. For extremely old systems there is nothing that can be done (except upgrading them).
