mirror of
https://github.com/dehydrated-io/dehydrated.git
synced 2026-01-11 22:30:44 +01:00
Certificate file also contains chain for ACME v2 #299
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mvistein on GitHub (Mar 13, 2018).
The certificate retrieved from Let's Encrypt ACMEv2 endpoint (both staging and production) contains both the end certificate and the intermediate certificate (which is conforming to 7.4.2 of the ACME draft). As a result, now the fullchain.pem file contains the intermediate certificate twice.
@thias commented on GitHub (Mar 14, 2018):
Also worth noting is that the intermediate certificate included in the
cert-<id>.pemfile seems to have Windows EOL, while the certificate above has proper UNIX EOL, so there a newline type mix in the file (this is on RHEL7).@cpu commented on GitHub (Mar 14, 2018):
@thias I think this is a mistake on the Let's Encrypt side. I opened https://github.com/letsencrypt/boulder/issues/3557 to track fixing this.
@lukas2511 commented on GitHub (Mar 14, 2018):
Whoopsie. The easiest solution for this would be to just completely ignore the old
chain.pemand just write the certificate directly tofullchain.pem, but that may break some setups...I'll need to figure out how to extract just issuer certificates from a file with multiple certificates... I guess since they are in order I could just sed and grep my way to those certificates, but does anybody know a cleaner way?
@mvistein commented on GitHub (Mar 14, 2018):
I think you could just process the file using the openssl x509 module.
On my system (version 1.0.2g) the following command yields the right result:
openssl x509 -in cert.pem -out cert2.pem@lukas2511 commented on GitHub (Mar 14, 2018):
Should be fixed with
2533931cf1, thanks for reporting this issue.@cpu commented on GitHub (Mar 14, 2018):
@thias This is fixed and should be consistently UNIX newlines now. Thanks for flagging it.
@thias commented on GitHub (Mar 19, 2018):
@lukas2511 @cpu : Thanks for the quick fixes. Let's Encrypt with wildcard certificates rocks! Thank you sooo much for your great work on your respective projects, it's MUCH appreciated.