Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5346 > unrolled thread
| Started by | tom@tomputer.nl |
|---|---|
| First post | 2017-12-12 16:40 +0100 |
| Last post | 2017-12-12 17:10 +0100 |
| Articles | 6 — 5 participants |
Back to article view | Back to linux.debian.security
Wheezy missing DigiCert Root G2 tom@tomputer.nl - 2017-12-12 16:40 +0100
Re: Wheezy missing DigiCert Root G2 Jeroen Mathon <jeroenmathonmac@gmail.com> - 2017-12-12 16:50 +0100
Re: Wheezy missing DigiCert Root G2 Tom Wijnroks <tom@tomputer.nl> - 2017-12-12 17:10 +0100
Re: Wheezy missing DigiCert Root G2 Clément Hermann <nodens@nodens.org> - 2017-12-12 16:50 +0100
Re: Wheezy missing DigiCert Root G2 Tom Wijnroks <tom@tomputer.nl> - 2017-12-12 17:00 +0100
Re: Wheezy missing DigiCert Root G2 SZÉPE Viktor <viktor@szepe.net> - 2017-12-12 17:10 +0100
| From | tom@tomputer.nl |
|---|---|
| Date | 2017-12-12 16:40 +0100 |
| Subject | Wheezy missing DigiCert Root G2 |
| Message-ID | <uVUP0-4Vy-5@gated-at.bofh.it> |
Hello, I just noticed that my Debian Wheezy server is missing a few Digicert Root certificates: Wheezy: * DigiCert_Assured_ID_Root_CA.crt * DigiCert_Global_Root_CA.crt * DigiCert_High_Assurance_EV_Root_CA.crt Jessie: * DigiCert_Assured_ID_Root_CA.crt * DigiCert_Assured_ID_Root_G2.crt * DigiCert_Assured_ID_Root_G3.crt * DigiCert_Global_Root_CA.crt * DigiCert_Global_Root_G2.crt * DigiCert_Global_Root_G3.crt * DigiCert_High_Assurance_EV_Root_CA.crt * DigiCert_Trusted_Root_G4.crt I already tried to update the ca-certificates but it is already the latest version: ca-certificates (20130119+deb7u1) Is there a reason why these Digicert Root certificates are missing on Wheezy? With kind regards, Tom Wijnroks
[toc] | [next] | [standalone]
| From | Jeroen Mathon <jeroenmathonmac@gmail.com> |
|---|---|
| Date | 2017-12-12 16:50 +0100 |
| Message-ID | <uVUYF-4YI-5@gated-at.bofh.it> |
| In reply to | #5346 |
[Multipart message — attachments visible in raw view] — view raw
Digicert Recently took over Thawte i am not sure if that might have anything todo with this. Perhaps they enrolled a new certificate? On 12/12/2017 04:41 PM, Clément Hermann wrote: > On 12/12/2017 16:25, tom@tomputer.nl wrote: >> Hello, >> >> I just noticed that my Debian Wheezy server is missing a few Digicert >> Root certificates: >> >> >> Wheezy: >> * DigiCert_Assured_ID_Root_CA.crt >> * DigiCert_Global_Root_CA.crt >> * DigiCert_High_Assurance_EV_Root_CA.crt >> >> Jessie: >> * DigiCert_Assured_ID_Root_CA.crt >> * DigiCert_Assured_ID_Root_G2.crt >> * DigiCert_Assured_ID_Root_G3.crt >> * DigiCert_Global_Root_CA.crt >> * DigiCert_Global_Root_G2.crt >> * DigiCert_Global_Root_G3.crt >> * DigiCert_High_Assurance_EV_Root_CA.crt >> * DigiCert_Trusted_Root_G4.crt >> >> I already tried to update the ca-certificates but it is already the >> latest version: >> >> ca-certificates (20130119+deb7u1) >> >> Is there a reason why these Digicert Root certificates are missing on >> Wheezy? > Wild guess: there was no such cert when wheezy was stable. Hence, no > reason to have it in an updated version of the ca-certificate package > (but a certificate from there could be removed because revoked). > > I'd suggest installing them manually until you can upgrade your system. > > Cheers, >
[toc] | [prev] | [next] | [standalone]
| From | Tom Wijnroks <tom@tomputer.nl> |
|---|---|
| Date | 2017-12-12 17:10 +0100 |
| Message-ID | <uVVi2-5np-23@gated-at.bofh.it> |
| In reply to | #5347 |
Hi Jeroen, On 2017-12-12 16:45, Jeroen Mathon wrote: > Digicert Recently took over Thawte i am not sure if that might have > anything todo with this. > > Perhaps they enrolled a new certificate? DigiCert also took over Symantec’s Website Security busines, which includes the SSL products. Some (or all) certificates are signed under the new SHA-256 Root, in this case DigiCert_Global_Root_G2. I came across this issue today because of failing cURL requests to external hosts, which installed these new DigiCert certificates. Regards, Tom Wijnroks
[toc] | [prev] | [next] | [standalone]
| From | Clément Hermann <nodens@nodens.org> |
|---|---|
| Date | 2017-12-12 16:50 +0100 |
| Message-ID | <uVUYF-4YI-7@gated-at.bofh.it> |
| In reply to | #5346 |
On 12/12/2017 16:25, tom@tomputer.nl wrote: > Hello, > > I just noticed that my Debian Wheezy server is missing a few Digicert > Root certificates: > > > Wheezy: > * DigiCert_Assured_ID_Root_CA.crt > * DigiCert_Global_Root_CA.crt > * DigiCert_High_Assurance_EV_Root_CA.crt > > Jessie: > * DigiCert_Assured_ID_Root_CA.crt > * DigiCert_Assured_ID_Root_G2.crt > * DigiCert_Assured_ID_Root_G3.crt > * DigiCert_Global_Root_CA.crt > * DigiCert_Global_Root_G2.crt > * DigiCert_Global_Root_G3.crt > * DigiCert_High_Assurance_EV_Root_CA.crt > * DigiCert_Trusted_Root_G4.crt > > I already tried to update the ca-certificates but it is already the > latest version: > > ca-certificates (20130119+deb7u1) > > Is there a reason why these Digicert Root certificates are missing on > Wheezy? Wild guess: there was no such cert when wheezy was stable. Hence, no reason to have it in an updated version of the ca-certificate package (but a certificate from there could be removed because revoked). I'd suggest installing them manually until you can upgrade your system. Cheers, -- nodens
[toc] | [prev] | [next] | [standalone]
| From | Tom Wijnroks <tom@tomputer.nl> |
|---|---|
| Date | 2017-12-12 17:00 +0100 |
| Message-ID | <uVV8m-523-13@gated-at.bofh.it> |
| In reply to | #5348 |
On 2017-12-12 16:41, Clément Hermann wrote: >> Is there a reason why these Digicert Root certificates are missing on >> Wheezy? > > Wild guess: there was no such cert when wheezy was stable. Hence, no > reason to have it in an updated version of the ca-certificate package > (but a certificate from there could be removed because revoked). > > I'd suggest installing them manually until you can upgrade your system. I can install them manually. However, because Wheezy is LTS, shouldn't ca-certificates be updated to still support new certificates? Most CA's will probably sign all new certificates under the SHA-256 Root certificates. Regards, Tom Wijnroks
[toc] | [prev] | [next] | [standalone]
| From | SZÉPE Viktor <viktor@szepe.net> |
|---|---|
| Date | 2017-12-12 17:10 +0100 |
| Message-ID | <uVVi2-5np-9@gated-at.bofh.it> |
| In reply to | #5349 |
Idézem/Quoting Tom Wijnroks <tom@tomputer.nl>: > On 2017-12-12 16:41, Clément Hermann wrote: >>> Is there a reason why these Digicert Root certificates are missing on >>> Wheezy? >> >> Wild guess: there was no such cert when wheezy was stable. Hence, no >> reason to have it in an updated version of the ca-certificate package >> (but a certificate from there could be removed because revoked). >> >> I'd suggest installing them manually until you can upgrade your system. > > I can install them manually. However, because Wheezy is LTS, > shouldn't ca-certificates be updated to still support new > certificates? Most CA's will probably sign all new certificates > under the SHA-256 Root certificates. I usually install ca-certs from testing. It has no dependencies. SZÉPE Viktor, honlap üzemeltetés https://github.com/szepeviktor/debian-server-tools/blob/master/CV.md -- +36-20-4242498 sms@szepe.net skype: szepe.viktor Budapest, III. kerület
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web