{"id":101490,"date":"2021-10-01T16:22:46","date_gmt":"2021-10-01T14:22:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/sboi-v-openbsd-dragonfly-bsd-i-electron-iz-za-ustarevaniya-kornevogo-sertifikata-identrust"},"modified":"2021-10-01T16:22:46","modified_gmt":"2021-10-01T14:22:46","slug":"sboi-v-openbsd-dragonfly-bsd-i-electron-iz-za-ustarevaniya-kornevogo-sertifikata-identrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/sboi-v-openbsd-dragonfly-bsd-i-electron-iz-za-ustarevaniya-kornevogo-sertifikata-identrust","title":{"rendered":"Crashes in OpenBSD, DragonFly BSD, and Electron due to the expiration of the IdenTrust root certificate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The expiration of the root certificate from IdenTrust (DST Root CA X3), used for cross-signing the root certificate of the Let's Encrypt certificate authority, has led to issues with verifying Let's Encrypt certificates in projects using older versions of OpenSSL and GnuTLS. The problems also affected the LibreSSL library, whose developers did not take into account past experiences related to failures that occurred after the expiration of the AddTrust root certificate of the Sectigo (Comodo) certificate authority. <\/p>\n
Let\u2019s recall that in OpenSSL versions up to and including branch 1.0.2, and in GnuTLS up to release 3.6.14, there was a bug that prevented the correct processing of cross-signed certificates when one of the root certificates involved in the signature became outdated, even if other valid trust chains remained (in the case of Let's Encrypt, the expiration of the IdenTrust root certificate prevents verification, even if the system supports a valid Let's Encrypt root certificate that remains active until 2030). The essence of the bug is that older versions of OpenSSL and GnuTLS parsed the certificate as a linear chain, while according to RFC 4158, a certificate can represent a directed distributed cyclic graph with multiple trust anchors that need to be considered. <\/p>\n
As a workaround to eliminate the failure, it is suggested to remove the certificate \"DST Root CA X3\" from the system store (\/etc\/ca-certificates.conf and \/etc\/ssl\/certs), after which the command \"update-ca-certificates -f -v\" should be executed. In CentOS and RHEL, the certificate \"DST Root CA X3\" can be blacklisted: trust dump \u2014filter \"pkcs11:id=\" | openssl x509 | sudo tee \/etc\/pki\/ca-trust\/source\/blacklist\/DST-Root-CA-X3.pem sudo update-ca-trust extract <\/ul>\n
Some of the failures observed after the expiration of the IdenTrust root certificate: <\/p>\n
\n
The syspatch utility used for installing binary system updates has stopped working in OpenBSD. The OpenBSD project has urgently released patches today for versions 6.8 and 6.9, addressing issues in LibreSSL related to the validation of cross-signed certificates, one of which has an expired root certificate in the trust chain. As a workaround, it is recommended to switch from HTTPS to HTTP in \/etc\/installurl (this does not pose a security threat as updates are additionally verified by digital signature) or select an alternative mirror (ftp.usa.openbsd.org, ftp.hostserver.de, cdn.openbsd.org). It is also possible to remove the expired root certificate DST Root CA X3 from the file \/etc\/ssl\/cert.pem.\n
Similar issues are observed in DragonFly BSD while working with DPorts. When launching the pkg package manager, a certificate validation error occurs. A fix has been added today to the branches master, DragonFly_RELEASE_6_0, and DragonFly_RELEASE_5_8. As a workaround, you can remove the DST Root CA X3 certificate.\n
The certificate verification process for Let's Encrypt has been disrupted in applications based on the Electron platform. The issue has been resolved in updates 12.2.1, 13.5.1, 14.1.0, and 15.1.0.\n
Some distributions are experiencing problems accessing package repositories when using the APT package manager, related to outdated versions of the GnuTLS library. Debian 9 is affected by this issue, where an unpatched GnuTLS package caused problems for users who did not timely install updates (the fix gnutls28-3.5.8-5+deb9u6 was proposed on September 17). As a workaround, it is recommended to remove DST_Root_CA_X3.crt from the file \/etc\/ca-certificates.conf.\n
The acme-client functionality has been disrupted in the OPNsense firewall distribution. The issue was reported in advance, but the developers were unable to release a patch in time.\n
The issue affected the OpenSSL 1.0.2k package in RHEL\/CentOS 7, but a week ago, an update for the ca-certificates-2021.2.50-72.el7_9.noarch package was issued for RHEL 7 and CentOS 7, which removed the IdenTrust certificate, effectively blocking the manifestation of the problem in advance. A similar update was also released a week ago for Ubuntu 16.04, Ubuntu 14.04, Ubuntu 21.04, Ubuntu 20.04, and Ubuntu 18.04. As the updates were released ahead of time, the certificate verification issue with Let's Encrypt only affected users of older branches of RHEL\/CentOS and Ubuntu who do not regularly install updates.\n
Certificate validation process disrupted in grpc.\n
Build failure on the Cloudflare Pages platform.\n
Issues in Amazon Web Services (AWS).\n
Database connection problems for DigitalOcean users.\n
Failure in the Netlify cloud platform.\n
Access issues with Xero services.\n
Failed to establish TLS connection to the MailGun Web API service.\n
Failures on macOS and iOS versions (11, 13, 14) that theoretically shouldn't have been affected.\n
Failure in Catchpoint services.\n
Certificate validation error when accessing the PostMan API.\n
Failure in Guardian Firewall.\n
Issues with the monday.com support page.\n
Failure in the Cerb platform.\n
Uptime check failure in Google Cloud Monitoring.\n
Certificate validation issues in Cisco Umbrella Secure Web Gateway.\n
Issues connecting to Bluecoat and Palo Alto proxies.\n
Connection issues with the OpenStack API at OVHcloud.\n
Problems generating reports in Shopify.\n
Issues observed when accessing the Heroku API.\n
Failure in Ledger Live Manager.\n
Certificate validation error in Facebook app development tools.\n
Issues with Sophos SG UTM.\n
Certificate validation problems in cPanel. <\/ul>\n