Christopher Bongaarts wrote:
> Christopher Bongaarts wrote:
>> The new certificate has been installed.
>
> Unfortunately this affected some high-profile applications, so I have
> temporarily reverted to the old certificate to give them a chance to get
> the new root cert in place. I expect to reinstall the new cert later
> today or at the latest tomorrow, when the old cert expires anyway.
We are planning to put the new certificate back in place tomorrow,
Saturday 11/6 at 5am.
> If anyone happened to notice apps stop working (the expected failure
> mode would be login looping - you try to log in to an application and it
> immediately kicks you back to the login page), please let the
> appropriate support people know.
>
>> I wrote:
>>> Attention web admins using CAH:
>>>
>>> The SSL certificate for x500.umn.edu (the validation service for CAH
>>> cookies) will be expiring shortly. We will be using the new InCommon
>>> CA to issue the new cert, which means the certificate will reference
>>> a different root CA than before.
>>>
>>> If your implementation of CAH checks the validity of the SSL
>>> certificates, you might want to ensure that the new root CA is
>>> trusted by the code that is performing the SSL connection.
>>>
>>> The Apache modules mod_cookieauth and mod_cookieauth2 do NOT validate
>>> the SSL certificates, and will NOT be affected by this change.
>>>
>>> Unless you specifically had to import the Thawte root cert and trust
>>> it in the past, then probably either (1) your software is not doing
>>> cert validation or (2) you already have the new root CA trusted. The
>>> latter is probably true of installations with a centralized system
>>> certificate store (e.g. Windows/IIS/.NET).
>>>
>>> If you do need to import the new root CA, I've included it below my
>>> signature. If you don't trust email, you can also export it from any
>>> recent browser (the certificate name is "AddTrust External CA Root",
>>> issued 05/30/2000).
>>>
>>> If you have a test instance of your server, you can try pointing your
>>> validation code at x500-test.umn.edu (instead of x500.umn.edu), on
>>> the usual port 87. It is already set up and configured with a
>>> certificate issued from the new CA. However, it references the test
>>> X.500 directory which is not fully populated, so send me email
>>> (privately) if you would like to have your production directory entry
>>> cloned over to the test directory temporarily.
>>>
>>> The production certificate expires on Saturday afternoon. In an
>>> attempt to allow folks to catch problems before the weekend, I'm
>>> planning to install the certificate on Friday at 10am. I apologize
>>> for the late notice; as most of our SSL certificates are
>>> browser-facing, the supported browsers all have the new root CAs so
>>> no action is necessary. But for a few things (such as this service),
>>> there is non-browser code making the connection so we can't make the
>>> same assumptions.
>>>
>>
>>
>
>
--
%% Christopher A. Bongaarts %% [log in to unmask] %%
%% OIT - Identity Management %% http://umn.edu/~cab %%
%% University of Minnesota %% +1 (612) 625-1809 %%
|