5 ms·

Right but my point still stands. Even if you look at the trust chain: They would’ve signed intermediate certs along the way. The intermediate certs would’ve

by atonse 5y ago

Right but my point still stands. Even if you look at the trust chain: They would’ve signed intermediate certs along the way. The intermediate certs would’ve had Expirations before this month Certs signed with the intermediates would’ve expired sooner too. They would’ve stopped signing Intermediate certs for this a few years ago. So what’s the actual risk here? Are there certs out there that have this Cert as a root, with expirations past the lifetime of this root cert? How would that have even been allowed?

kxrm 5y ago
The risk is, older devices. Many devices aren't updated anymore, so they won't have newer root certs. You could argue that those users shouldn't be using those devices with the web, but they do.
- wtetzner 5y ago
  I think they still support a cross-signed root, so hopefully those users will still be OK.
tialaramex 5y ago
> The intermediate certs would’ve had Expirations before this month No. Nobody does that. Why would you do that? I think you're most likely getting muddled because, in common with many people, you've been thinking about the Web PKI as a graph in which certificates are nodes. It isn't. It's a graph in which the nodes are key pairs, and the certificates are labelled, directional edges. You're suggesting that the labels on any one edge ought to be constrained based on all other labels on edges leading toward the node it's from, and that makes no sense, unsurprisingly we don't do that. > They would’ve stopped signing Intermediate certs for this a few years ago. Again, nobody does this. > So what’s the actual risk here? Are there certs out there that have this Cert as a root, with expirations past the lifetime of this root cert? How would that have even been allowed? Imagine somebody loudly insisting that negative integers don't exist. That they can't exit, they just don't make any sense, obviously there can't be a "minus six" what would that even mean? Frustrating right. That's what this is like.
- tflinton 5y ago
  But doesn’t antose comment still apply? If all the certificates issued by letsencrypts old CA have expired (since they’ve stopped issuing certs for a year, and their certificates only last 3 months) wouldn’t it stand to reason that if a certificate on and old CA have been replaced with a new CA certificate? And it would then stand to reason any devices that aren’t updated would have slowly watched the web degrade already? In other words with letsencrypt there’s no cliff everyone walks off when the root ca expires, it’s more a 90-day descending hill.
  - tialaramex 5y ago
    You're failing to think about it as a graph. Here's a graph to look at: https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/ Let's try a concrete example, https://letest.tlrmx.org/ https://letest.tlrmx.org/ is a simple test site, it has a normal Let's Encrypt certificate. This certificate was issued by R3, the same intermediate issuing most (but not all) Let's Encrypt end-entity certificates today and this certificate doesn't expire until November. On the graph that certificate is a labelled edge from what we'll call the R3 keypair to my keypair for letest.tlrmx.org, saying that R3 certifies this is really letest.tlrmx.org (and www.letest.tlrmx.org) But, because it's a graph there are two certificates (actually three but we'll ignore that) for that R3 keypair. One of them is signed by DST Root CA X3, this one says R3 is certified as a CA by DST Root CA X3, and since DST Root CA X3 expires later this month, that certificate too expires later this month. However, there is also a certificate for R3 saying it's a CA, signed by ISRG Root X1 and that doesn't expire until 2025. If we trust DST Root CA X3 this is all fine... for about a week. But if we trust ISRG Root X1 it's still fine until 2025, which is ages. Immediately one bug rears its head. Software such as older OpenSSL versions may trust DST Root CA X3, notice it's expiring and then falsely conclude this is untrustworthy, even though it also trusts ISRG Root X1. That's a pretty bad idea, but you can bet some people are still running this. We can continue following the graph to ISRG Root X1 but is this enough that you now see why atonse's simple view of the world is wrong?
- simondotau 5y ago
  > Imagine somebody loudly insisting that negative integers don't exist. That they can't exit, they just don't make any sense, obviously there can't be a "minus six" what would that even mean? Frustrating right. That's what this is like. Context matters. If your task is to count the number of gumballs in a jar, the person loudly insisting upon the non-existence of negative integers would be correct. Within this context, "minus six" doesn't exist and doesn't mean anything.

by atonse 5y ago

kxrm 5y ago

The risk is, older devices. Many devices aren't updated anymore, so they won't have newer root certs. You could argue that those users shouldn't be using those devices with the web, but they do.

wtetzner 5y ago
I think they still support a cross-signed root, so hopefully those users will still be OK.

tialaramex 5y ago

> The intermediate certs would’ve had Expirations before this month No. Nobody does that. Why would you do that? I think you're most likely getting muddled because, in common with many people, you've been thinking about the Web PKI as a graph in which certificates are nodes. It isn't. It's a graph in which the nodes are key pairs, and the certificates are labelled, directional edges. You're suggesting that the labels on any one edge ought to be constrained based on all other labels on edges leading toward the node it's from, and that makes no sense, unsurprisingly we don't do that. > They would’ve stopped signing Intermediate certs for this a few years ago. Again, nobody does this. > So what’s the actual risk here? Are there certs out there that have this Cert as a root, with expirations past the lifetime of this root cert? How would that have even been allowed? Imagine somebody loudly insisting that negative integers don't exist. That they can't exit, they just don't make any sense, obviously there can't be a "minus six" what would that even mean? Frustrating right. That's what this is like.

tflinton 5y ago
But doesn’t antose comment still apply? If all the certificates issued by letsencrypts old CA have expired (since they’ve stopped issuing certs for a year, and their certificates only last 3 months) wouldn’t it stand to reason that if a certificate on and old CA have been replaced with a new CA certificate? And it would then stand to reason any devices that aren’t updated would have slowly watched the web degrade already? In other words with letsencrypt there’s no cliff everyone walks off when the root ca expires, it’s more a 90-day descending hill.
- tialaramex 5y ago
  You're failing to think about it as a graph. Here's a graph to look at: https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/ Let's try a concrete example, https://letest.tlrmx.org/ https://letest.tlrmx.org/ is a simple test site, it has a normal Let's Encrypt certificate. This certificate was issued by R3, the same intermediate issuing most (but not all) Let's Encrypt end-entity certificates today and this certificate doesn't expire until November. On the graph that certificate is a labelled edge from what we'll call the R3 keypair to my keypair for letest.tlrmx.org, saying that R3 certifies this is really letest.tlrmx.org (and www.letest.tlrmx.org) But, because it's a graph there are two certificates (actually three but we'll ignore that) for that R3 keypair. One of them is signed by DST Root CA X3, this one says R3 is certified as a CA by DST Root CA X3, and since DST Root CA X3 expires later this month, that certificate too expires later this month. However, there is also a certificate for R3 saying it's a CA, signed by ISRG Root X1 and that doesn't expire until 2025. If we trust DST Root CA X3 this is all fine... for about a week. But if we trust ISRG Root X1 it's still fine until 2025, which is ages. Immediately one bug rears its head. Software such as older OpenSSL versions may trust DST Root CA X3, notice it's expiring and then falsely conclude this is untrustworthy, even though it also trusts ISRG Root X1. That's a pretty bad idea, but you can bet some people are still running this. We can continue following the graph to ISRG Root X1 but is this enough that you now see why atonse's simple view of the world is wrong?
simondotau 5y ago
> Imagine somebody loudly insisting that negative integers don't exist. That they can't exit, they just don't make any sense, obviously there can't be a "minus six" what would that even mean? Frustrating right. That's what this is like. Context matters. If your task is to count the number of gumballs in a jar, the person loudly insisting upon the non-existence of negative integers would be correct. Within this context, "minus six" doesn't exist and doesn't mean anything.