Certificate chain names

Help
13

Hi @Osiris

The terms "short" and "long" aren't official terms. I don't know where you read these terms, but perhaps that location should have made a better effort of explaining it.

The terms "short" and "long" are mentioned in several posts, but mainly this one: Long (default) and Short (alternate) Certificate Chains Explained

Also this one: Shortening the Let's Encrypt Chain of Trust - Let's Encrypt refers to "the longer chain" and "the shorter chain" and mentions that "The longer chain, terminating at the soon-to-expire cross-sign, will still be available as an alternate chain which you can configure your client to request".

They're not. RFC 8555 (ACME) gives ACME servers the option to include multiple chains with a Link: rel="alternate" header when providing the ACME client with the certificate.

I stand corrected. I really thought the alternate links included a "canonical" name chosen by the server, and which could then be used by the clients to select the desired alternate chain. After reading your last post and going through the details of RFC 8555 I see that this is not the case.

I wonder why, though. Wouldn't it make sense for the server to advertise alternate chains with an explicit name? This would make things much easier as the server could then document the names of the available chains, thus providing an unambiguous way for users to specify their preferred chain, which would not depend on the actual client used. With the current spec (where the alternate links do not include a name) each client must come up with their own way to select alternate chains.

How the ACME client parses and presents these alternate chains is up to the ACME client. They're not named by Let's Encrypt nor the ACME protocol.

I understand this now. Sorry for the confusion and thanks for explaining.

As a constructive criticism I would like to say the following:

  1. I still believe the diagram in the "Chain of Trust" page is very confusing for people not familiar with LE's implementation. I'm not sure how to improve that but I can say it is not clear at all for newcomers.

  2. The "Shortening the Let's Encrypt Chain of Trust" post linked above mentions that ACME clients can be configured to request alternate chains but does not provide any further hints on how to do this. This is what confused me in the first place. I think that this could easily be improved by simply mentioning that the way to select this alternate chain is actually client-specific. That would have gotten me on the right track probably.

Thanks.

2 Likes