Wrong/expired intermediate ca(s) and root ca for staging env

Issuance Tech
1

The intermediate ca downloaded from the AIA url is expired. This happens to staging LE cert. For production, it works normally.

Normally, before this week, the chains looks good. But from this week, the ca downlaoded from ths url is expired.

 Alternative Name:
      URL=http://stg-x1.i.lencr.org/
1 Like
2

image
image582×716 63 KB

1 Like
3

Welcome @lperry

I moved your post to a different category. Just seemed better than Site Feedback which is for requests to improve the website.

I can readily recreate what you describe. I can't say I have ever chased the AIA for Staging certs like this so I'll accept your word that it worked correctly before.

Having the Doctored Durian Root CA X3 show up anywhere seems wrong.

For others, I recreated it by issuing a new staging cert today. Its leaf AIA points to the expected intermediate (Pseudo Plum E5 in my case).

Looking up that E5 intermediate shows the AIA as you describe. And, the E5 intermediate shows Issued by: Issuer: C=US, O=(STAGING) Internet Security Research Group, CN=(STAGING) Pretend Pear X1 which seems normal.

Retrieving the E5 AIA gets the below. I realize this repeats what you say I just think the Doctored Durian issuer is worth adding to the thread :slight_smile:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ed:5d:5b:c9:6d:fb:df:4d:3e:cd:6a:49:8d:d1:b3:c7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Doctored Durian Root CA X3
        Validity
            Not Before: Jan 20 19:14:03 2021 GMT
            Not After : Sep 30 18:14:03 2024 GMT
        Subject: C = US, O = (STAGING) Internet Security Research Group, CN = (STAGING) Pretend Pear X1
5 Likes
4

I can confirm.

Looks like somehow http://stg-x1.i.lencr.org/ is currently serving some older version of the chain.

3 Likes
5

We'll take a look.

6 Likes
6

Thanks @MikeMcQ for looking into this issue. To be accurate, I use R10/R11 since I use RSA cert. Nevermind, your E5 Pretend Pear X1 also got expired. :laughing:

3 Likes
7

Thanks @mcpherrinm for follow up

2 Likes
8

stg-x1.i.lencr.org has been updated with the self-signed Pretend Pear X1

        Issuer: C=US, O=(STAGING) Internet Security Research Group, CN=(STAGING) Pretend Pear X1
8 Likes
9

Appreciate the great help! It works now.

Cheers
Perry

3 Likes
10

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.