As announced (OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates) expiration of DST Root CA X3 causing issues for clients with OpenSSL < 1.1.0. As there are still some very old Centos/RHEL 6 Servers (openssl-1.0.1e-58.el6_10.x86_64) out there (especially some of our VM Hosting/Housing Customers still resist upgrading some of their legacy system) and today some of those Customers contacted our Support I'm puzzled on how to remove the old X3 (ISRG Root X1 is already available in the last ca-certificates rpm) from those Centos/RHEL 6 Servers ... (after suggesting that they should upgrade to newer OS of course ... :wink: ) Any ideas on that? Thank you, bye from Austria Andy

@ Osiris - thx - it's working like a charm with the manually compiled RPMs! :wink: For the sake of completeness, here again the complete workflow to solve the DST Root CA X3 expiration problem with Centos / RHEL 6 ... yum install wget yum install krb5-devel zlib-devel lksctp-tools-devel util-linux make gcc rpm-build curl -o openssl-1.0.2k-21.el7_9.src.rpm https://vault.centos.org/7.9.2009/updates/Source/SPackages/openssl-1.0.2k-21.el7_9.src.rpm rpm -i openssl-1.0.2k-21.el7_9.src.rpm cd ~/rpmbuild/SOURCES/ sed -i 's/secure_getenv(/getenv(/g' *patch cd ../SPECS/ sed -i 's/%patch68 -p1 -b .secure-getenv/#%patch68 -p1 -b .secure-getenv/g' openssl.spec rpmbuild -bb openssl.spec cd ../RPMS/x86_64 rpm -U openssl-libs-1.0.2k-21.el6.x86_64.rpm openssl-1.0.2k-21.el6.x86_64.rpm I also compiled a current ca-certificates so one doesn't need to manually remove the X3 Cert ... How to build the ca-certificates RPM: yum install asciidoc java-1.6.0-openjdk mkdir -p /dl/ca-cert; cd /dl/ca-cert; curl -o ca-certificates-2020.2.41-65.1.el6_10.src.rpm https://vault.centos.org/6.10/updates/Source/SPackages/ca-certificates-2020.2.41-65.1.el6_10.src.rpm rpm -i ca-certificates-2020.2.41-65.1.el6_10.src.rpm curl -o ca-certificates-2021.2.50-72.el7_9.src.rpm https://vault.centos.org/7.9.2009/updates/Source/SPackages/ca-certificates-2021.2.50-72.el7_9.src.rpm rpm2cpio ca-certificates-2021.2.50-72.el7_9.src.rpm | cpio -idmv cp certdata.txt ~/rpmbuild/SOURCES/ sed -i 's/Version: 2020.2.41/Version: 2021.2.50/g' ~/rpmbuild/SPECS/ca-certificates.spec cd ~/rpmbuild/SPECS rpmbuild -bb ca-certificates.spec cd /root/rpmbuild/RPMS/noarch/ rpm -U ca-certificates-2021.2.50-65.1.el6.noarch.rpm If someone is interested I could also publish the RPMs ... (I personally wouldn't install any RPMs from "foreign sources" on my servers ... ^^) thx, bye from Austria Andreas Schnederle-Wagner

My latest info was that CentOS/RHEL 6 ships OpenSSL 1.0.1, while 7 ships OpenSSL 1.0.2. The workarounds known for OpenSSL (removing the old root is one of them) only work on OpenSSL 1.0.2. Unless RHEL 6 has backported patches*, I'm not aware of anything you can do for those. The CentOS/RHEL 7 discussion was here: RHEL/CentOS 7 OpenSSL client compatibility after new chain - #3 by ghen *There were no patches for RHEL 6 back in May this year, but I don't know if the situation has changed since then.

[image] futureweb: I'm puzzled on how to remove the old X3 (+adding the not expired X3) from those Centos/RHEL 6 Servers Note that there is no such thing as a "not expired X3". In principle, Let's Encrypt uses its own ISRG Root X1 root certificate. The only reason the LE default certificate chain still chains up to DST Root CA X3 is for older Android support. But that does not mean there's going to be a new DST Root CA X3: it's gone and will never return. You probably need to add ISRG Root X1 to the root stores.

Have same issue. How can we install new root cert on Centos 6?

[image] Osiris: You probably need to add ISRG Root X1 to the root stores. If it's unpatched OpenSSL 1.0.1, this won't help. (If patches were available, I would hope they also include ISRG Root X1?)

[image] Osiris: You probably need to add ISRG Root X1 to the root stores. of course ... my fault ... corrected in posting ... thx! :slight_smile:

Removing the X3 from server fixed the issue here: First you need to update CA certificates to add the new X1 cert. yum update ca-certificates Then look for the old X3 sudo nano /etc/ssl/certs/ca-bundle.crt Search for "DST Root CA X3" in this file and delete the X3 certificate. Save file and be happy :slight_smile:

[image] klingersoares1: Then look for the old X3 sudo nano /etc/ssl/certs/ca-bundle.crt Search for "DST Root CA X3" in this file and delete the X3 certificate. Save file and be happy already tried to manually delete the X3 - but had no effect on Centos 6 Test-Server ...

probably only if openssl also updated somehow? as on OpenSSL 1.0.1e-fips which is latest for Centos 6.10 it won't help

[image] Nummer378: If it's unpatched OpenSSL 1.0.1, this won't help. Even if DST Root CA X3 is removed, as suggested in this thread?

[image] Osiris: Even if DST Root CA X3 is removed, as suggested in this thread? Yes, for me it didn't help

RHEL/CentOS 6 OpenSSL client compatibility after DST Root CA X3 expiration

Help

futureweb September 30, 2021, 8:43pm 6

of course ... my fault ... corrected in posting ... thx!

Topic		Replies	Views
RHEL/CentOS 7 OpenSSL client compatibility after new chain Help	42	17409	October 9, 2021
Openssl is unable to get local issuer certificate ever since DST Root X3 expired Help	28	24111	December 24, 2021
One of these certs is not like the others -DST Root CA X3 breaking antique hosts Help	13	1278	November 26, 2023
Help thread for DST Root CA X3 expiration (September 2021) Help	665	174536	December 26, 2021
Correct ca bundle to use Issuance Tech	69	12849	October 10, 2021

RHEL/CentOS 6 OpenSSL client compatibility after DST Root CA X3 expiration

Related topics