Date: Wed, 20 Oct 2021 15:13:33 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=259314 Bug ID: 259314 Summary: security/ca_root_nss: still including expired let's encrypt certificate causing issues Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: Individual Port(s) Assignee: ports-secteam@FreeBSD.org Reporter: email@example.com Assignee: ports-secteam@FreeBSD.org Flags: maintainer-feedback?(ports-secteam@FreeBSD.org) Hello, Do we know when security/ca_root_nss will simply remove the expired certificate DST Root CA X3 from their bundle? We're running FreeBSD 12.2 and are using a software stack being exposed to this bug in openssl  which is also documented by the guys at TrueNas  (because the technology we rely on maintains its own old fork of openssl). Basically, because of this bug in openssl if the expired certificate is present in the trust store, the expired cert is picked instead of the new one, which of course results in a TLS authentication failure. So apps cannot connect to websites and APIs using a let's encrypt certificate... (which represents many endpoints these days). We're going to keep removing the cert manually for time being but this is not a sustainable solution I'm afraid, it'd be much better if upstream just removed it. How fast are expired certs usually removed from the bundle? : https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/ : https://www.truenas.com/community/threads/ssl-certificate-problem-certificate-has-expired-the-openssl-1-0-2-vs-letsencrypt-issue.95874/ -- You are receiving this mail because: You are the assignee for the bug.