Public bug reported:
Recent Let's Encrypt certificates use Y generation root certificates
including YE and YR (1),(2),(3).
The latest ca-certifiates package included in different Ubuntu OS series
(20260601) is missing and failing to validate any TLS certificates
signed using these roots specifically YR in my example bellow:
$ openssl s_client -connect <REDACTED>:443 -servername <REDACTED>
-verify_hostname <REDACTED> -verify_return_error -showcerts </dev/null
Connecting to 10.1.8.90
CONNECTED(00000003)
depth=2 C=US, O=ISRG, CN=Root YR
verify error:num=19:self-signed certificate in certificate chain
40D7BFBEEB7D0000:error:0A000086:SSL
routines:tls_post_process_server_certificate:certificate verify
failed:../ssl/statem/statem_clnt.c:2124:
---
Running an independent openssl verify from an Ubuntu Resolute machine
against this root cert returns the same error:
$ openssl verify <(curl -q https://letsencrypt.org/certs/gen-y/root-yr.pem)
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1850 100 1850 0 0 19699 0 0
C=US, O=ISRG, CN=Root YR
error 18 at 0 depth lookup: self-signed certificate
error /dev/fd/63: verification failed
Would it be possible to patch the package to include these and it is
very cumbersome to copy these to every single individual machine in a
given environment.
Thank you,
Alan
(1) https://letsencrypt.org/certificates/
(2) https://letsencrypt.org/certs/gen-y/root-ye-by-x2.txt
(3) https://letsencrypt.org/certs/gen-y/root-yr-by-x1.txt
** Affects: ca-certificates (Ubuntu)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Trusty)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Xenial)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Bionic)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Focal)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Jammy)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Noble)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Resolute)
Importance: Undecided
Status: New
** Affects: ca-certificates (Ubuntu Stonking)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Resolute)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Noble)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Jammy)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Focal)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Stonking)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Bionic)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Xenial)
Importance: Undecided
Status: New
** Also affects: ca-certificates (Ubuntu Trusty)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162678
Title:
Missing Y generation roots results in validation errors
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2162678/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
