Bug 546778 – Some hosts on *.gentoo.org have unneccessary cert in chain

• Product: Gentoo Infrastructure
• Status: RESOLVED FIXED

[Description Hanno Böck 2015-04-16 11:47:30 UTC]

Several Gentoo webpages using a Digicert certificate seem to have an unneccessary cert in the chain. See here:
https://www.ssllabs.com/ssltest/analyze.html?d=gentoo.org

The server sends three chain certificates:
DigiCert High Assurance EV Root CA
DigiCert High Assurance CA-3
DigiCert SHA2 High Assurance Server CA

The "DigiCert SHA2 High Assurance Server CA" is signing our certificate. The "DigiCert High Assurance EV Root CA" is a cross-signed Digicert root for old browsers not having the digicert root. (This should be replaced by a sha2-version, but that's an independent issue, I'll open another bug for that.)

But the "DigiCert High Assurance CA-3" seems to have no meaning whatsoever. I think it can safely be removed.

[Comment 1 Alex Legler (RETIRED) 2015-04-19 09:30:16 UTC]

(In reply to Hanno Boeck from comment #0)
> Several Gentoo webpages using a Digicert certificate seem to have an
> unneccessary cert in the chain. See here:
> https://www.ssllabs.com/ssltest/analyze.html?d=gentoo.org

Hooray for the qualys bug of the month.

I think it's cute how people scan 'gentoo.org' and miss the about 40 other hosts, but anyway.

> 
> The server sends three chain certificates:

The server being www and forums yes, they did. wiki.gentoo.org which you included in your original summary on the other hand already had the new CA bundle at the time of your writing.

> (This should be replaced by a
> sha2-version, but that's an independent issue, I'll open another bug for
> that.)

We got the message that sha1 is phased out, and have already started updating the intermediates; so thanks, but you can skip filing that bug.

So, to make that pesky warning go away, I pushed the remaining certs. (As always pending config management runs)