Entrust: Difference between revisions
Sectigo signing certificate info |
|||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
Entrust is a certificate authority. | Entrust is a certificate authority. | ||
== Sectigo == | |||
Google stopped trusting Entrust signed certificates since around June 2024. Entrust has since started signing their certificates through Sectigo. The certificate chain for a EV certificate now looks like this: | |||
USERTrust RSA Certification Authority | |||
* [https://paste.steamr.com/view/raw/97e71c82 Sectigo Public Server Authentication Root R46] | |||
** [https://paste.steamr.com/view/raw/8a4028f7 Entrust EV TLS Issuing RSA CA 2] | |||
Like Entrust's crap certs, you'll have to install the Sectigo and Entrust intermediate certs to make most things work. For some reason, I don't see the intermediate certs listed on their website, so the links above go to a copy on my pastebin. | |||
== Troubleshooting == | == Troubleshooting == | ||
| Line 29: | Line 39: | ||
| lang = terminal | | lang = terminal | ||
}}On Debian:{{Highlight | }}On Debian:{{Highlight | ||
| code = # mkdir -p /usr/share/ca-certificates | | code = # mkdir -p /usr/local/share/ca-certificates | ||
# cd /usr/share/ca-certificates | # cd /usr/local/share/ca-certificates | ||
# curl https://web.entrust.com/root-certificates/entrust_l1k.cer > entrust_l1k.cer | # curl https://web.entrust.com/root-certificates/entrust_l1k.cer > entrust_l1k.cer | ||
# curl https://web.entrust.com/root-certificates/entrust_g2_ca.cer > entrust_g2_ca.cer | # curl https://web.entrust.com/root-certificates/entrust_g2_ca.cer > entrust_g2_ca.cer | ||
Latest revision as of 16:25, 2 July 2025
Entrust is a certificate authority.
Sectigo
Google stopped trusting Entrust signed certificates since around June 2024. Entrust has since started signing their certificates through Sectigo. The certificate chain for a EV certificate now looks like this:
USERTrust RSA Certification Authority
Like Entrust's crap certs, you'll have to install the Sectigo and Entrust intermediate certs to make most things work. For some reason, I don't see the intermediate certs listed on their website, so the links above go to a copy on my pastebin.
Troubleshooting
The Entrust Root Certification Authority (G2) doesn't appear to be part of the system root CA. As a result, if you try to wget or curl to a resource using certificates signed by Entrust, you'll get an error like the one below.
# wget -O - https://somewhere.ucalgary.ca/
--2022-03-29 16:58:39-- https://somewhere.ucalgary.ca/
Resolving somewhere.ucalgary.ca (somewhere.ucalgary.ca)... 10.43.144.134
Connecting to somewhere.ucalgary.ca (somewhere.ucalgary.ca)|10.43.144.134|:443... connected.
ERROR: cannot verify somewhere.ucalgary.ca's certificate, issued by ‘CN=Entrust Certification Authority - L1K,OU=(c) 2012 Entrust\\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\\, Inc.,C=US’:
Unable to locally verify the issuer's authority.
To connect to somewhere.ucalgary.ca insecurely, use `--no-check-certificate'.
To fix this, you'll need to install the root and chain certificates that are provided by Entrust at https://www.entrust.com/resources/certificate-solutions/tools/root-certificate-downloads.
Installing certificates
On RHEL based systems:
# wget https://web.entrust.com/root-certificates/entrust_l1k.cer -O /usr/share/pki/ca-trust-source/anchors/entrust_l1k.cer
# wget https://web.entrust.com/root-certificates/entrust_g2_ca.cer -O /usr/share/pki/ca-trust-source/anchors/entrust_g2_ca.cer
# wget https://web.entrust.com/root-certificates/entrust_l1m_sha2.cer -O /usr/share/pki/ca-trust-source/anchors/entrust_l1m_sha2.cer
# update-ca-trust extract
On Ubuntu:
# wget https://web.entrust.com/root-certificates/entrust_l1k.cer -O /usr/share/ca-certificates/entrust_l1k.cer
# wget https://web.entrust.com/root-certificates/entrust_g2_ca.cer -O /usr/share/ca-certificates/entrust_g2_ca.cer
# wget https://web.entrust.com/root-certificates/entrust_l1m_sha2.cer -O /usr/share/ca-certificates/entrust_l1m_sha2.cer
# update-ca-certificates
On Debian:
# mkdir -p /usr/local/share/ca-certificates
# cd /usr/local/share/ca-certificates
# curl https://web.entrust.com/root-certificates/entrust_l1k.cer > entrust_l1k.cer
# curl https://web.entrust.com/root-certificates/entrust_g2_ca.cer > entrust_g2_ca.cer
# curl https://web.entrust.com/root-certificates/entrust_l1m_sha2.cer > entrust_l1m_sha2.cer
# for i in *cer; do openssl x509 -inform PEM -in $i -outform PEM -out ${i%.cer}.crt ; done
# update-ca-certificates