DST Root CA X3 in root certs is expired

[virtuakazib]

Version

All currently maintained/supported versions

Platform

All platforms

Subsystem

No response

What steps will reproduce the bug?

Using NodeJS TLS client to connect to a server that uses the Let's Encrypt DST Root CA X3 cert as it's root certificate and the client depends on the root certificates bundled with NodeJS.

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior?

No response

What do you see instead?

No response

Additional information

I understand that NodeJS developers can provide their own root certificates or provide alternate certificate chains for client requests, but it seems like good policy to not included expired certificates in the hard coded certificates bundled with NodeJS releases.

The exact location of the expired cert is here: https://github.com/nodejs/node/blob/master/src/node_root_certs.h#L367

[richardlau]

We updated the root certs to the most recent available NSS (3.71, https://wiki.mozilla.org/NSS:Release_Versions) in #40280.

I'll defer to @nodejs/crypto as to whether we wait for the expired cert to be removed upstream or float a patch to remove it.

[mildsunrise]

Hi! All certificates are subject to the same rules, like expiry checking, even if they are in the trust store. Policy-wise, there is nothing wrong with an expired cert being in the trust store, it just won't be used (assuming your date is right). NSS will remove it eventually and we'll get it here.

However. OpenSSL 1.0.2 has an important bug where it only considers the first verification path to the trust store, and then it checks expiry. DST Root CA X3 hits this bug. Workarounds for the bug include:

• Removing the cert from the trust store.
• Using the trusted_first option to prefer the new chain.
• Updating the server to return the new chain, preventing OpenSSL from finding the old path. (this has the drawback of breaking compatibility for older Androids)

But we don't have any active releases with OpenSSL 1.0.2, I think?

tl;dr @virtuakazib make sure you're running an up to date version of Node

[richardlau]

But we don't have any active releases with OpenSSL 1.0.2, I think?

Correct, all currently supported versions of Node.js (12, 14, 16, 17) are compiled with OpenSSL 1.1.1. YMMV with Node.js packaged by Linux distributions (which tend to use the OpenSSL from the distribution rather than statically compiling into node). FWIW if you're using Electron they had to patch due to a difference in defaults between BoringSSL and OpenSSL (electron/electron#31213).

[virtuakazib]

Thanks for all the feedback. Sorry to take up your time.

[mildsunrise]

No worries :)

[mildsunrise]

@richardlau wow, I had no idea BoringSSL also used the wrong behavior... that must have caused a bit of an apocalypse