Bad server certificate trying to get to the top-level https://shibboleth.net from AWS or a zscaler address

[Paul Wilt]

Two comments:
1. I figured why my updates were failing for the Shibboleth SP we have on AWS.

Our SP servers run on an Amazon Linux 2 kernel that behaves as a CentOS 7 kernel.
The last time I ran a full update of the server infrastructure was 2019.
Unfortunately, the cert bundles under /etc/pki/tls had expired.

Updating those cert bundles corrected the problem.

2. It appears someone fixed the browser-related certificate error I was experiencing when trying to access https://www.shibboleth.net.

Whoever runs www.shibboleth.net<http://www.shibboleth.net> seems to have fixed the certificates that caused my zscaler InternetSecurity system to bitterly complain when I would try to access the Shibboleth Consortium.  Thanks to whoever made that change!!!  Greatly appreciated.

Cheers,
Paul
[https://www.shibboleth.net/wp-content/uploads/2020/11/shibboleth-share.jpg]<http://www.shibboleth.net/>
Shibboleth Consortium - Shaping the future of Shibboleth Software<http://www.shibboleth.net/>
The Shibboleth Consortium is committed to ensuring our team of dedicated developers are able to keep the software freely available to users.
www.shibboleth.net






________________________________
From: users <users-bounces at shibboleth.net> on behalf of mat houser <mhouser at uwm.edu>
Sent: Friday, February 25, 2022 12:26 PM
To: Shib Users <users at shibboleth.net>; users at shibboleth.net <users at shibboleth.net>
Subject: Re: Bad server certificate trying to get to the top-level https://shibboleth.net from AWS or a zscaler address

FWIW I started noticing that a bunch of certs issued by Let's Encrypt
are being reported as expired by curl and openssl s_client on some
systems. The affected systems all appear to have been running for
quite some time without getting updated.

RHEL6 (eol Dec 2020 iirc) shows expired as does a "managed" Mac that
hasn't been updated in a very long time. Anything that's been kept up to
date does not show those certificates as expired. My suspicion is that
anything that hasn't been updated since the Let's Encrypt root cert
expired back in September might be relying on an obsolete CA bundle or
something, and updating the client OS should probably fix it.

--
-------------
mat:houser
mhouser at uwm.edu
uwm:uits:iam-support
-------------

On Fri, 25 Feb 2022, Peter Schober wrote:

* Cantor, Scott <cantor.2 at osu.edu> [2022-02-25 14:35]:
> Even the cert on https://urldefense.com/v3/__http://www.shibboleth.net__;!!NknhfzgzgQ!jCREGPJzdADDzHRBImrYjWkvWlKRotp9IoTp-Aa0pLabXG3hQ870-H9QQWcG5nknRv4$ , which is not run by us, is still valid.

That server has a misconfigured cert chain, though, by producing only
the leaf/server certificate but not the intermediate one.
(SSL certificate problem: unable to get local issuer certificate)

But while JISC should fix that ASAP[1] that wouldn't cause an expired
certificate error either, of course...

-peter

[1] The reason this hasn't caused sufficient problems in practice is
that browsers cache intermediates, it seems, and that most browsers
will know the (missing) intermediate from other, correctly configured,
servers. It's still wrong, of course.
--
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NknhfzgzgQ!jCREGPJzdADDzHRBImrYjWkvWlKRotp9IoTp-Aa0pLabXG3hQ870-H9QQWcGcv_LM0s$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

Confidentiality note: This e-mail may contain confidential information from Clarivate. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this e-mail is strictly prohibited. If you have received this e-mail in error, please delete this e-mail and notify the sender immediately.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220301/dc641672/attachment.htm>