aboutsummaryrefslogtreecommitdiffstats
path: root/global-config.rsc
diff options
context:
space:
mode:
authorGravatar Christian Hesse <mail@eworm.de>2024-06-20 09:50:39 +0200
committerGravatar Christian Hesse <mail@eworm.de>2024-06-21 15:55:45 +0200
commitd1693a241b0ec444d7ad469681e4ba81c1b398df (patch)
treecf5cd457f153cf7f20acb2e0608e4cba3bef9915 /global-config.rsc
parent35f4ec0b1d1d8c26ec9293efe2d9091993d7bf89 (diff)
certs: E1 / E5 -> ISRG Root X2
In the beginning of Let's Encrypt their root certificate ISRG Root X1 was not widely trusted, at least some older and/or mobile platforms were missing that certificate in their root certificate store. At that time Let's Encrypt was using an alternative chain of trust, where a certificate was cross-signed with DST Root CA X3. To make sure a valid chain of trust is available under all circumstances a set of all certificates had to be supplied: both root vertificates ISRG Root X1 & DST Root CA X3, and an intermediate certificate. This was still true after DST Root CA X3 expired, as it could still be used as a root anchor and was shipped by Let's Encrypt when requested. 🤪 This time is finally over, and we have a clean chain for trust ending in ISRG Root X1 (or ISRG Root X2). Well, actually it is the other way round... Let's Encrypt signs with different tantamount intermediate certificates. There is not only E5, but also E6 - and we can not know beforehand which one is used on renew. So let's jetzt drop the intermediate certificates now, and rely on root certificates only. We are perfectly fine with this these days. Follow-up commits will do the same for *all* certificates. The certificate is downloaded with: curl -d '["ISRG Root X2"]' https://mkcert.org/generate/ | grep -v '^$' > certs/ISRG-Root-X2.pem
Diffstat (limited to 'global-config.rsc')
-rw-r--r--global-config.rsc6
1 files changed, 3 insertions, 3 deletions
diff --git a/global-config.rsc b/global-config.rsc
index a0835f8..734b51e 100644
--- a/global-config.rsc
+++ b/global-config.rsc
@@ -92,11 +92,11 @@
:global FwAddrLists {
# "allow"={
# { url="https://git.eworm.de/cgit/routeros-scripts/plain/fw-addr-lists.d/allow";
-# cert="E5"; timeout=1w };
+# cert="ISRG Root X2"; timeout=1w };
# };
"block"={
# { url="https://git.eworm.de/cgit/routeros-scripts/plain/fw-addr-lists.d/block";
-# cert="E5" };
+# cert="ISRG Root X2" };
{ url="https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt";
cert="GlobalSign Atlas R3 DV TLS CA 2022 Q3" };
{ url="https://sslbl.abuse.ch/blacklist/sslipblacklist.txt";
@@ -112,7 +112,7 @@
};
# "mikrotik"={
# { url="https://git.eworm.de/cgit/routeros-scripts/plain/fw-addr-lists.d/mikrotik";
-# cert="E5"; timeout=1w };
+# cert="ISRG Root X2"; timeout=1w };
# };
};
:global FwAddrListTimeOut 1d;