Let’s Encrypt 與 IdenTrust 延長三年的 cross sign 在 2024/10/01 要結束了

先前 Let’s Encrypt 跟 IdenTrust 的 cross sign 會在 2024/09/30 到期，可以參考 3958242236 這邊的資訊，可以看到由 IdenTrust 的 DST Root CA X3 對 Let’s Encrypt (ISRG) 的 ISRG Root X1 簽名，時間是到 2024/09/30 18:14:03 GMT (換算大概是台灣隔日的清晨兩點多)：

Issuer: (CA ID: 276)
commonName = DST Root CA X3
organizationName = Digital Signature Trust Co.
Validity
Not Before: Jan 20 19:14:03 2021 GMT
Not After : Sep 30 18:14:03 2024 GMT
Subject: (CA ID: 7394)
commonName = ISRG Root X1
organizationName = Internet Security Research Group
countryName = US

所以 Let’s Encrypt 這邊也整理出了對應的落日計畫：「Shortening the Let’s Encrypt Chain of Trust」。

第一波是 2024/02/08，從這個時間點開始 Let’s Encrypt 的 ACME 服務預設組出來的 SSL certificate 將不會帶 IdenTrust 提供的 cross sign 憑證，但你還是可以自己另外設定取用：

On Thursday, Feb 8th, 2024, we will stop providing the cross-sign by default in requests made to our /acme/certificate API endpoint. For most Subscribers, this means that your ACME client will configure a chain which terminates at ISRG Root X1, and your webserver will begin providing this shorter chain in all TLS handshakes. The longer chain, terminating at the soon-to-expire cross-sign, will still be available as an alternate chain which you can configure your client to request.

再來是過期前的 90 天多一點的 2024/06/06，Let’s Encrypt 的 ACME 服務將不會提供 cross sign 的憑證：

On Thursday, June 6th, 2024, we will stop providing the longer cross-signed chain entirely. This is just over 90 days (the lifetime of one certificate) before the cross-sign expires, and we need to make sure subscribers have had at least one full issuance cycle to migrate off of the cross-signed chain.

最後就是過期的日子 2024/09/30：

On Monday, September 30th, 2024, the cross-signed certificate will expire. This should be a non-event for most people, as any client breakages should have occurred over the preceding six months.

依照說明，應該是 Android 7.0 以及之前的版本會產生問題，照目前的數字看起來是 100% – 93.9% = 6.1%：

接下來一年應該會再低一些，但不確定會低多少，有機會 <5% 嗎？

Read More