Testing upcoming changes on Feb 8th using Certes library

pj2112 · December 27, 2023, 4:25pm

Hello all,
I faced problems issueing certificates mid November 2023 as mentioned in this thread
https://community.letsencrypt.org/t/production-environment-we-are-getting-exception-when-processing-orders/208263 and did also receive the error message 'Can not find issuer 'C=US,O=Internet Security Research Group,CN=ISRG Root X1' for certificate 'C=US,O=Let's Encrypt,CN=R3'.

After code inspection (which was written by a previous member in our organization) I did update the certes library to version 3.0.4 (https://github.com/fszlin/certes), however I am not sure if I need to take further steps to avoid facing an issue on Feb 8th. Is there a possibility to test this before Feb 8th? Or would one of you nice people know if this library version update is sufficient? I did set the preferred chain parameter to "ISRG Root X1" on the certes generate call as well.

Many thanks in advance!

petercooperjr · December 27, 2023, 7:47pm

I'm not familiar with certes specifically, but if you're already using the chain rooted in ISRG Root X1 then I'd expect that you'd be all set. All that will be changing in February is which chain is the default.

webprofusion · December 28, 2023, 1:56am

Set your preferred issuer to ISRG Root X1 in the code and you will get the newer chain, that will prove it all works. The preferred issuer is set in certes when you download the cert. certes/src/Certes/Acme/IOrderContext.cs at main · fszlin/certes · GitHub

pj2112 · December 28, 2023, 7:59pm

I have checked the code in question. There is no call to the certes download method as the certificate is fetched when calling the certes generate method, where I can also specify the preferred chain. Do you know if this is sufficient? Many thanks for your help.

webprofusion · December 29, 2023, 1:52am

Yes, obviously you should test independently to your production systems but the preferredChain argument in Generate is then passed through to the Download method:

github.com

fszlin/certes/blob/main/src/Certes/Extensions/IOrderContextExtensions.cs#L70


      
          /// Finalizes and download the certifcate for the order.
          /// </summary>
          /// <param name="context">The order context.</param>
          /// <param name="csr">The CSR.</param>
          /// <param name="key">The private key for the certificate.</param>
          /// <param name="retryCount">Number of retries when the Order is in 'processing' state. (default = 1)</param>
          /// <param name="preferredChain">The preferred Root Certificate.</param>
          /// <returns>
          /// The certificate generated.
          /// </returns>
          public static async Task<CertificateChain> Generate(this IOrderContext context, CsrInfo csr, IKey key, string preferredChain = null, int retryCount = 1)
          {
              var order = await context.Resource();
              if (order.Status != OrderStatus.Ready && // draft-11
                  order.Status != OrderStatus.Pending) // pre draft-11
              {
                  throw new AcmeException(string.Format(Strings.ErrorInvalidOrderStatusForFinalize, order.Status));
              }
          
              order = await context.Finalize(csr, key);

pj2112 · December 29, 2023, 1:15pm

Thank you.

system · January 28, 2024, 1:15pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Certes.AcmeException: Can not find issuer 'C=US,O=Internet Security Research Group,CN=ISRG Root X1' for certificate 'C=US,O=Let's Encrypt,CN=R3' Client dev	8	2029	March 22, 2024
Guidance Request: Any experience using Certes .Net client from GitHub? Help	15	928	August 7, 2022
Certbot has been configured to prefer certificate chains with issuer 'ISRG Root X1', but no chain from the CA matched this issuer. Using the default certificate chain instead Help	21	4331	February 8, 2022
Error when trying to renew my certificate (with an unchanged operation since years) Help	4	702	March 16, 2024
Chain has the wrong root certificate (update: no it doesn't) Help	4	444	October 14, 2023

Testing upcoming changes on Feb 8th using Certes library

Related topics