RHEL/CentOS 7 OpenSSL client compatibility after new chain

Unfortunately, CentOS 8 is going EOL at the end of this year, whereas CentOS 7 will be kicking around until 2024.

At least for CentOS 7, there's an enormous number of cPanel servers which are probably going to stay around until the bitter end, which makes me a little worried about the impact. Those can't be upgraded and it's a big effort to migrate customers off them.

Edit: Using @Nummer378's great test cases here, it seems that an up-to-date CentOS 7 can't verify the chain:

[root@plugindev ~]# cat /etc/centos-release
CentOS Linux release 7.9.2009 (Core)

[root@plugindev ~]# rpm -q openssl
openssl-1.0.2k-21.el7_9.x86_64

[root@plugindev ~]# openssl s_client -connect expired-root-ca-test.germancoding.com:443 -servername expired-root-ca-test.germancoding.com -verify 1 -verifyCAfile certs-combined.pem
verify depth is 1
CONNECTED(00000003)
depth=3 C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Doctored Durian Root CA X3
verify error:num=10:certificate has expired
notAfter=Jan 30 14:01:15 2021 GMT
140169193727888:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:s3_clnt.c:1264:
3 Likes