0

We have added two CA certificates - 1 root CA and 1 associated intermediate CA - into the according OS trust store (/etc/ssl/certs on our SuSE 11), because they weren't provided by the OS'es trust store (and probably will never, since tey are not in the repo).

Recently these two certificates disappeared after an auto-update, with the obvious effect that clients weren't able to connect via tls any longer.

In hindsight we are not sure if we did the usual rehash of the entries, i.e.

    # c_rehash /etc/ssl/certs

IF we did not do the rehash: Would this have been the reason for the deletion of the according certificates during the update?

Or is there always a risk of loosing certificates if they are added to the trust store by hand (on the system in question are two ssl libraries: openssl and mozilla-nss) ?

Improve this question

1 Answer 1

Reset to default
1

You don't add subordinate CAs to the trust-anchor store. You only explicitly trust the Root CA (the trust-anchor) and implicitly trust all certificates signed by that Root CA or any subordinate CA of that Root.

If you can't build the chain between the end-entity and the trust-anchor then check whether the end-entity is presenting all certificates between itself and the trust-anchor. See RFC 5256 Section 7.4.2, specifically the certificate_list; which states that all certificates (with optionally the Root) must be presented in the TLS handshake.

As an aside, Microsoft clients have the ability to download missing subordinate CA certificates if the URL to the certificate is specified in the AIA extension. Others such as Mozilla Firefox will not use that extension, citing user privacy as their justification.

Note that if you explicitly trust a subordinate CA there is no guarantee that your client will be checking the revocation of its certificate. If at a future point the subordinate is compromised and revoked by the Root CA, your client may well continue to trust it. It'll be implementation specific.

Improve this answer
2
  • Thanks for your useful advice. I just lack the crucial information if there is a risk of loosing the manually added certificate entries in one way or another.
    – MarkHelms
    Feb 22, 2018 at 9:10
  • Probably. But if your manually added certificates are signed by a Root CA that is in your trust-anchor store, you need to fix your servers to send the whole chain and not shoehorn the subordinate certs in as you are doing. Note that most distros have a directory to which you add local root certificates which can be imported without loss during an update. As you've not stated your distro, you'll need to Google how it's done on yours.
    – garethTheRed
    Feb 23, 2018 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .