<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">The complexity of the problem…<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Begin forwarded message:</div><br class="Apple-interchange-newline"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">raf <<a href="mailto:macports@raf.org" class="">macports@raf.org</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">Re: Let's Encrypt DST Root CA X3 Expiration</b><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">2 October 2021 at 23:32:45 GMT-3<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><a href="mailto:macports-users@lists.macports.org" class="">macports-users@lists.macports.org</a><br class=""></span></div><br class=""><div class=""><div class="">On Sat, Oct 02, 2021 at 04:14:05AM -0500, Ryan Schmidt <<a href="mailto:ryandesign@macports.org" class="">ryandesign@macports.org</a>> wrote:<br class=""><br class=""><blockquote type="cite" class=""><a href="http://macports.org" class="">macports.org</a> and other secure web sites that use Let's Encrypt may<br class="">no longer be accessible to you if you use older versions of macOS<br class="">or older browsers or user agents. For example, the libcurl in macOS<br class="">10.14 can't talk to many Let's Encrypt web sites now, including<br class=""><a href="http://distfiles.macports.org" class="">distfiles.macports.org</a> and <a href="http://packages.macports.org" class="">packages.macports.org</a>, and MacPorts uses<br class="">macOS libcurl to download things. Safari and many browsers don't use<br class="">libcurl so they may be affected differently.<br class=""><br class="">Let's Encrypt is a free certificate provider used by <a href="http://macports.org" class="">macports.org</a><br class="">and many other web sites to provide https encryption. Certificates<br class="">they issue depend on their "ISRG Root X1" certificate which was<br class="">cross-signed by the "DST Root CA X3" certificate, because DST Root<br class="">CA X3 was more widely accepted by browsers when Let's Encrypt got<br class="">started years ago. Both of these root certificates are included in the<br class="">certificate chain served by web sites that use Let's Encrypt.<br class=""><br class="">ISRG Root X1 itself has been trusted by browsers for some time<br class="">now and DST Root CA X3 expired a couple days ago on September 30,<br class="">2021. Apparently in order to provide the widest compatibility,<br class="">certificate chains continue to list the old expired root certificate<br class="">after the new one. The idea as I understand it is that browsers should<br class="">see the ISRG Root X1 certificate, realize that it itself is already<br class="">trusted by the OS or browser, and not even look at the next expired<br class="">DST Root CA X3 certificate in the chain.<br class=""><br class="">They advertised this root certificate expiration as being a very minor<br class="">situation, but unfortunately it seems that a large portion of Apple<br class="">devices cannot deal with this change. On many Macs, it seems that the<br class="">entire certificate chain is being validated, and the expired extra<br class="">root certificate is causing the connection to be disallowed. What<br class="">alerted me to the problem in the first place was seeing many failed<br class="">builds on our Buildbot system due to fetch failures.<br class=""><br class="">I'm not certain what to do to address this. On the web servers<br class="">we control, we can apparently remove the expired DST Root CA X3<br class="">certificate from the chain that we send. That will help those<br class="">systems that already trust ISRG Root X1. I'm not sure how far back<br class="">that is. For older systems, we can modify master_sites.tcl and<br class="">archive_sites.tcl to change which OS versions try to access our mirror<br class="">servers via https. None of this necessarily helps our build server be<br class="">able to mirror distfiles in the first place. If you have ideas, let me<br class="">know.<br class=""><br class=""><a href="https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/" class="">https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/</a><br class=""></blockquote><br class="">There is a discussion on the LetsEncrypt community site<br class="">with instructions for installing the ISRG Root X1<br class="">certificate on older versions of macOS:<br class=""><br class=""> <a href="https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/16" class="">https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/16</a><br class=""><br class="">Here are instructions for 10.10 and 10.11:<br class=""><br class=""> <a href="https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/25" class="">https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/25</a><br class=""><br class="">Here's another approach that worked on 10.9.5 and<br class="">10.11.6 (i.e., override the expiry by always trusting<br class="">DST Root CA X3:<br class=""><br class=""> <a href="https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/28" class="">https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/28</a><br class=""><br class="">Here's my approach for 10.6.8 because the above didn't<br class="">work (i.e., export root certificates from a later macOS<br class="">and import them):<br class=""><br class=""> <a href="https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/36" class="">https://community.letsencrypt.org/t/connection-errors-on-apple-devices/161107/36</a><br class=""><br class="">But these are all client-side fixes. The only<br class="">server-side fix seems to be to change to a different<br class="">certificate authority. I didn't see any mention of<br class="">removing the DST Root CA X3 certificate from the chain.<br class="">That would probably only work from macOS 10.12 onwards.<br class="">ISRG Root X1 is only trusted by macOS since 10.12.<br class="">Earlier than that, it needs to be added.<br class=""><br class="">The rest is a bit rambly. It might be best to just<br class="">consult the LetsEncrypt community forum above.<br class=""><br class="">I should mention that I didn't notice any problems with<br class="">macports on 10.6.8. curl has its own root certificates<br class="">and they are fine. And I was able to do an upgrade. But<br class="">I might have already installed the ISRG Root X1<br class="">certificate at least into my "local" keychain before<br class="">trying it (or maybe into the "System" and "System<br class="">Roots" keychains).<br class=""><br class="">However, I still don't think that it's entirely OK.<br class="">Firefox on 10.6.8 can access <a href="http://macports.org" class="">macports.org</a> with no<br class="">problem (but it certainly wasn't accessing my<br class="">LetsEncrypt-certified sites beforehand), but Sarafi<br class="">tells me that it can't verify <a href="http://macports.org" class="">macports.org</a>'s identity,<br class="">but it still lets me access it. If I quit and restart<br class="">Safari, and visit <a href="http://macports.org" class="">macports.org</a>, it does the same thing.<br class="">Firefox uses its own root certificates. Safari uses the<br class="">system ones. But I definitely have ISRG Root X1 in both<br class="">the "System" and "System Roots" keychains. So I don't<br class="">know why Safari has a problem. In Keychain Access, it's<br class="">marked as "Always Trust" but it also says "trusted for<br class=""><a href="http://macports.org" class="">macports.org</a>" (I don't know why it says that). That's<br class="">confusing. But in Safari, when viewing the certificate,<br class="">there was a checkbox labelled "Always trust". After<br class="">checking it, quitting and restarting Safari, it visited<br class=""><a href="http://macports.org" class="">macports.org</a> without complaint.<br class=""><br class="">I should also mention that I can't find DST Root CA X3<br class="">in my 10.6.8 keychains. So that's wierd. Otherwise, I<br class="">probably should have set it to always trust (not that<br class="">having ISRG Root X1 set to always trust convinced<br class="">Safari to trust it immediately - I had to tell Safari<br class="">itself to trust it as well).<br class=""><br class="">cheers,<br class="">raf<br class=""><br class=""></div></div></blockquote></div><br class=""></body></html>