Plans for new ECDSA root and new intermediates from Let's Encrypt

397 views
Skip to first unread message

Jacob Hoffman-Andrews

unread,
Aug 25, 2020, 12:40:33 PM8/25/20
to dev-secur...@lists.mozilla.org
Let’s Encrypt is planning to issue a new root and new intermediates soon.
The new root will be an ECDSA one, to augment our existing RSA root. The
new intermediates will be part of our regular replacement of intermediates.
Our RSA root will cross-sign the ECDSA root.

We’re sharing our detailed issuance plans, including certificate profiles
and the tools we will use to generate the certificates. This is in the
spirit of transparency and also to get feedback from the community about
our plans.

Originally posted at
https://community.letsencrypt.org/t/detailed-2020-hierarchy/131019:

I’ve put together a detailed demonstration at
https://github.com/letsencrypt/2020-hierarchy-demo. I’ve attached sample
output from a run here, along with OpenSSL textual output. If you see any
flaws, please let us know!


Notable things:

-

We’re continuing to use X1 / X2 to identify roots.
-

We’re using O=Let’s Encrypt, CN=E1, E2, R3, and R4 to identify
intermediates, where E/R indicates the key type, and we chose
non-overlapping numbers across key types to make the names even easier to
visually distinguish.
-

We’re using P-384 for our ECDSA hierarchy. We will continue to issue
both P-256 and P-384 end-entity (leaf) certificates.
-

Per Ballot SC31 <https://github.com/cabforum/documents/pull/195>, we are
not including OCSP URLs in our intermediates. This makes them smaller (for
faster handshakes) and also simplifies our operations. The ballot has
passed. We plan to perform the ceremony after the ballot’s review period
has also passed and it takes effect.
-

We’re adopting a new domain for URLs in certificates: lencr.org. This
saves some bytes.
-

For intermediates, we are just including CPS OIDs, not CPS URLs. Our
end-entity certificates contain our CPS URL, so including it in the
intermediates uses bytes unnecessarily.


The below is sample output from our demonstration:

root-x2.cert.pem.txt:

```text

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

0d:e3:b6:d6:c3:12:af:10:9c:8b:74:de:8b:3a:97:a0

Signature Algorithm: ecdsa-with-SHA384

Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2

Validity

Not Before: Sep 4 00:00:00 2020 GMT

Not After : Sep 17 16:00:00 2040 GMT

Subject: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root
X2

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey

Public-Key: (384 bit)

pub:

04:aa:a9:a7:6e:c0:cd:01:16:af:60:ba:35:ea:d9:

02:8e:fb:ec:b8:c9:9f:a6:5c:50:f4:fc:25:99:af:

76:4c:22:50:8d:62:86:1d:51:58:b9:2d:39:dc:1a:

ca:76:1d:44:83:6c:93:94:01:b1:e3:9c:27:d6:e8:

61:ac:ab:bc:7f:4e:7f:d9:8a:43:d5:57:dd:72:87:

70:1c:25:c7:41:78:ad:ce:58:86:79:61:ff:ee:a3:

2b:9c:c3:5f:9d:b7:36

ASN1 OID: secp384r1

NIST CURVE: P-384

X509v3 extensions:

X509v3 Key Usage: critical

Certificate Sign, CRL Sign

X509v3 Basic Constraints: critical

CA:TRUE

X509v3 Subject Key Identifier:

5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0

Signature Algorithm: ecdsa-with-SHA384

30:65:02:31:00:d2:6c:91:04:a7:d6:21:73:d0:52:f1:68:eb:

4b:34:98:9a:43:57:9d:fe:d2:61:fc:c0:c1:ec:5f:58:f6:c9:

b9:ea:84:3e:1f:3a:20:e4:85:dd:72:36:00:53:1e:30:88:02:

30:02:25:a3:c4:ac:6e:97:70:6f:b3:cd:4f:59:95:55:b9:e7:

52:f1:4d:a6:a0:a3:07:77:40:d4:dc:05:7b:26:9e:b9:be:05:

b9:0f:c0:5f:9e:cc:3a:1c:de:e7:8b:2b:93

```

x2-signed-by-x1.txt

```text

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

07:d7:a2:bb:0c:dc:93:25:d0:be:e2:26:39:de:7b:d0

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1

Validity

Not Before: Sep 4 00:00:00 2020 GMT

Not After : Sep 15 16:00:00 2025 GMT

Subject: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root
X2

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey

Public-Key: (384 bit)

pub:

04:77:df:ec:6c:fe:22:06:aa:2e:8f:54:ce:1d:30:

60:01:85:ca:92:d6:d6:3d:21:0f:e5:18:1b:d5:35:

a4:72:ad:2d:07:56:cc:fe:0c:f5:39:2b:da:1a:83:

bf:a2:1a:9d:96:a2:74:2d:01:84:32:30:35:e0:a1:

e4:8a:fe:7f:16:58:83:13:e2:49:f2:01:84:60:98:

ef:07:4f:3c:f6:0c:86:21:22:33:aa:4e:6d:45:01:

da:8b:98:fb:c8:db:a5

ASN1 OID: secp384r1

NIST CURVE: P-384

X509v3 extensions:

X509v3 Key Usage: critical

Certificate Sign, CRL Sign

X509v3 Basic Constraints: critical

CA:TRUE

X509v3 Subject Key Identifier:

55:49:E8:C3:B7:0B:25:64:96:86:E3:F8:0D:E3:F3:4B:34:9E:23:84

X509v3 Authority Key Identifier:


keyid:B3:89:A4:0B:1C:64:C4:E7:E7:00:5B:CA:02:D5:8C:16:D7:77:D0:F9

Authority Information Access:

CA Issuers - URI:http://x1.i.lencr.org/

X509v3 CRL Distribution Points:

Full Name:

URI:http://x1.c.lencr.org/

X509v3 Certificate Policies:

Policy: 2.23.140.1.2.1

Policy: 1.3.6.1.4.1.44947.1.1.1

Signature Algorithm: sha256WithRSAEncryption

76:d6:43:74:4d:4f:8c:67:dc:12:d3:e4:0e:06:97:a9:66:42:

a7:e9:d2:33:b5:1f:75:c1:4a:12:1d:8a:8d:ef:cd:2f:12:59:

1b:b1:c1:1b:ee:60:11:2f:ea:41:16:35:cc:12:ac:2e:7a:d2:

78:dd:dd:66:40:c9:18:cb:b4:a3:79:8e:98:91:7b:46:8d:c7:

e7:d1:d5:1c:e8:72:d2:3b:b2:05:b4:52:97:d7:72:9b:fc:bd:

b5:1c:f1:3c:b0:f8:70:16:21:2d:10:73:a0:14:0a:92:77:39:

3f:85:11:26:29:1a:06:b3:2f:79:36:28:54:6a:de:f7:65:a2:

07:1a:5c:64:c6:1a:23:97:9e:2c:58:7e:bc:45:22:3b:d2:e4:

23:f6:92:a5:5e:a8:11:f1:1a:ed:2f:3a:bf:81:a0:de:c4:5c:

00:83:31:54:95:65:cb:07:95:53:95:62:af:48:b4:e1:09:aa:

a3:73:86:a6:a0:14:c5:fd:0a:d0:05:16:22:e4:93:ec:75:3b:

d5:c1:78:68:7a:12:b8:00:29:5b:c4:6f:73:aa:05:d7:0f:ab:

a2:a0:25:1d:7c:e3:77:9b:24:01:a7:58:c2:b7:e7:6d:fd:9c:

db:b9:e1:19:c4:34:b2:f0:30:a8:c7:fa:97:14:fd:57:c9:e0:

5e:b0:aa:b4:ab:7f:bd:03:b2:4f:12:05:45:10:4d:78:74:13:

89:e8:5a:e3:45:03:74:96:13:ff:9b:81:f3:21:45:0b:d6:ec:

e6:8f:dc:96:f0:88:1b:67:32:11:f4:45:2c:e2:e4:2d:ff:6c:

79:bc:fa:e0:39:e0:44:d5:02:86:3b:d5:0b:4f:a3:35:29:9a:

ab:66:ff:8b:1b:37:1f:de:be:89:7e:25:67:64:8c:4c:1d:0f:

d6:8d:de:2a:a2:f5:3f:eb:5f:c9:89:db:6d:5a:3a:90:83:fb:

6d:31:40:a1:82:f8:3b:b0:5a:75:8d:32:fb:26:59:90:73:a0:

fa:8a:e7:50:c1:87:8c:50:01:ba:20:f4:b9:fa:2d:66:8b:fc:

b9:b4:d3:bc:e9:64:24:fa:4b:9f:cc:3d:ab:d7:b2:d3:a7:5e:

c8:de:13:ac:5c:2d:68:ec:4b:9f:8c:0b:24:ee:39:6f:34:45:

80:7f:9a:16:be:b8:10:e7:42:fb:1e:81:33:3e:6f:98:68:6d:

83:93:09:92:1e:73:50:77:92:04:5b:76:56:9a:ac:20:aa:39:

87:18:76:f9:6a:b5:61:dc:5e:eb:2c:8c:c1:b9:0a:7f:27:77:

d9:ad:e6:99:d6:ff:06:2f:47:e3:cf:00:9e:33:1d:ff:61:51:

db:66:a4:9c:fe:54:39:e5

```

root-x2.crl.pem.txt

```text

Certificate Revocation List (CRL):

Version 2 (0x1)

Signature Algorithm: ecdsa-with-SHA384

Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2

Last Update: Sep 4 00:00:00 2020 GMT

Next Update: Aug 4 00:00:00 2021 GMT

CRL extensions:

X509v3 Authority Key Identifier:


keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0

X509v3 CRL Number:

100

No Revoked Certificates.

Signature Algorithm: ecdsa-with-SHA384

30:65:02:31:00:f2:ff:1c:52:20:ef:9d:1c:6d:74:95:10:47:

44:66:05:e1:10:5f:1e:72:a2:10:4a:19:25:fd:94:be:1b:17:

c8:f6:a5:30:07:88:db:8b:92:dd:be:08:f1:f5:34:67:73:02:

30:74:e1:4e:86:9e:ef:1f:7b:14:91:01:fe:d7:7b:0b:11:b7:

4b:cb:d1:f4:ad:12:37:e6:c5:8f:00:fa:8f:35:15:e0:ac:93:

77:45:80:e5:c9:46:17:81:4a:71:d0:a6:0b

```

int-e1.cert.pem.txt

```text

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

9b:51:80:12:58:e4:c1:87:4a:42:99:4f:30:69:3f:dd

Signature Algorithm: ecdsa-with-SHA384

Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2

Validity

Not Before: Sep 4 00:00:00 2020 GMT

Not After : Sep 15 16:00:00 2025 GMT

Subject: C = US, O = Let's Encrypt, CN = (FAKE) E1

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey

Public-Key: (384 bit)

pub:

04:42:03:f9:9f:d0:6c:9f:a4:80:5a:29:f4:e1:63:

6c:87:d0:ec:cf:f4:ef:a9:ed:51:75:e4:c7:d7:fa:

aa:89:b6:40:ef:f4:8e:85:af:02:b3:2d:57:e9:eb:

55:9c:03:bd:6e:9c:1d:0d:72:01:10:54:c0:5f:a9:

34:fe:6e:fe:15:e4:7c:67:c5:94:6b:52:42:10:67:

21:52:0c:b7:a5:63:df:1f:e1:87:5f:d7:fd:30:be:

d6:11:df:65:03:22:4e

ASN1 OID: secp384r1

NIST CURVE: P-384

X509v3 extensions:

X509v3 Key Usage: critical

Certificate Sign, CRL Sign

X509v3 Extended Key Usage:

TLS Web Client Authentication, TLS Web Server Authentication

X509v3 Basic Constraints: critical

CA:TRUE, pathlen:0

X509v3 Subject Key Identifier:

41:C5:56:06:07:79:77:7B:4B:12:0C:52:00:79:FD:73:E2:F9:7E:E7

X509v3 Authority Key Identifier:


keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0

Authority Information Access:

CA Issuers - URI:http://x2.i.lencr.org/

X509v3 CRL Distribution Points:

Full Name:

URI:http://x2.c.lencr.org/

X509v3 Certificate Policies:

Policy: 2.23.140.1.2.1

Policy: 1.3.6.1.4.1.44947.1.1.1

Signature Algorithm: ecdsa-with-SHA384

30:65:02:30:4a:89:e2:09:c5:0e:fc:bb:6c:4f:9f:86:e0:35:

8f:f1:53:d3:c0:5f:c1:2e:98:52:b3:45:c6:3f:56:b4:b4:bb:

f7:5e:c4:1d:05:5e:10:95:c5:ee:46:c6:11:88:e3:53:02:31:

00:f8:b6:31:d2:c4:47:28:52:b4:84:84:9c:37:0d:56:64:89:

bd:cb:80:6b:16:db:8c:54:f8:e1:74:f5:c3:e7:99:cf:4f:66:

99:b4:60:a3:44:2b:d0:88:85:18:9b:fe:6b

```

int-e2.cert.pem.txt

```text

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

55:16:37:77:f4:32:11:39:63:1d:ac:6c:59:2f:e3:4d

Signature Algorithm: ecdsa-with-SHA384

Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2

Validity

Not Before: Sep 4 00:00:00 2020 GMT

Not After : Sep 15 16:00:00 2025 GMT

Subject: C = US, O = Let's Encrypt, CN = (FAKE) E2

Subject Public Key Info:

Public Key Algorithm: id-ecPublicKey

Public-Key: (384 bit)

pub:

04:b8:f3:3c:11:cf:55:8d:cd:d8:7e:db:1e:91:1f:

3e:0f:53:e4:ff:35:69:b7:9d:5c:cb:5a:ec:69:4c:

7f:64:c9:46:d0:95:0a:4e:e0:04:06:17:a7:25:bc:

a5:34:03:43:ca:47:3d:65:65:3e:9c:0a:7d:66:57:

77:e9:fa:24:ae:57:49:7b:5e:88:5c:ab:6d:67:e1:

b1:23:92:0d:c1:05:d7:3b:31:90:45:9f:d6:97:0c:

03:24:73:ad:2d:f9:76

ASN1 OID: secp384r1

NIST CURVE: P-384

X509v3 extensions:

X509v3 Key Usage: critical

Certificate Sign, CRL Sign

X509v3 Extended Key Usage:

TLS Web Client Authentication, TLS Web Server Authentication

X509v3 Basic Constraints: critical

CA:TRUE, pathlen:0

X509v3 Subject Key Identifier:

E9:BE:44:E8:A5:D6:BE:35:7F:7E:93:02:72:6E:C6:D7:4B:43:F6:E3

X509v3 Authority Key Identifier:


keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0

Authority Information Access:

CA Issuers - URI:http://x2.i.lencr.org/

X509v3 CRL Distribution Points:

Full Name:

URI:http://x2.c.lencr.org/

X509v3 Certificate Policies:

Policy: 2.23.140.1.2.1

Policy: 1.3.6.1.4.1.44947.1.1.1

Signature Algorithm: ecdsa-with-SHA384

30:65:02:30:0e:ef:00:95:54:e2:36:9c:f2:7a:2b:a5:98:4d:

d9:fc:d4:85:b6:31:75:3c:25:02:bb:91:33:93:9c:dc:14:5f:

a6:16:a0:1b:e7:e4:53:01:76:f7:60:cc:74:9a:45:8c:02:31:

00:e8:c5:d0:1e:d7:11:25:13:f1:ad:3b:b1:75:48:56:d3:bb:

9c:e3:54:72:33:0f:bd:b1:47:f3:88:49:74:74:65:cf:f3:d6:

73:54:ef:80:76:a2:fa:f0:9d:4c:01:1a:51

```

int-r3.cert.pem.txt

```text

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

99:84:df:97:40:a4:ee:80:26:4b:91:37:38:4c:54:f0

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1

Validity

Not Before: Sep 4 00:00:00 2020 GMT

Not After : Sep 15 16:00:00 2025 GMT

Subject: C = US, O = Let's Encrypt, CN = (FAKE) R3

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public-Key: (2048 bit)

Modulus:

00:ad:4a:7e:29:b0:40:3f:5d:02:2a:e6:a0:61:36:

b5:53:da:9b:43:a9:a8:cc:77:cc:b3:42:1f:2c:45:

e5:be:ed:82:44:64:fa:f6:11:0b:55:b1:94:cb:c4:

ed:65:bd:80:cb:42:f6:10:53:42:bb:cd:d6:53:b1:

11:25:fc:87:63:e0:fa:17:92:a7:f0:11:a0:93:14:

51:94:c3:00:17:3d:57:43:84:c7:6a:28:0c:bf:b7:

ea:93:43:c1:55:f9:93:e8:b1:1d:99:de:8a:c1:ad:

51:73:f7:fe:a1:35:c1:d2:08:56:25:59:d7:e8:e4:

ca:a8:cc:e1:58:d7:d7:47:75:76:06:da:8a:1c:59:

75:e9:33:50:33:cb:8c:30:f3:c3:b4:85:e2:7d:64:

11:e0:61:b8:6c:52:37:97:d8:7f:f5:68:78:01:a2:

45:3b:6c:6d:01:5e:e4:da:db:a6:72:30:71:12:8d:

25:d0:3f:6f:ab:c7:bf:f2:90:0c:76:7e:d7:26:c6:

76:e7:f1:6c:b0:4b:50:46:c6:a5:ef:e3:80:5c:b7:

bc:6e:86:51:ee:a5:6f:bc:95:11:6b:63:74:07:54:

b5:6b:47:cc:05:83:9e:c6:64:ed:e6:2a:77:33:d9:

9f:1b:f3:6b:26:60:77:84:6c:c1:23:c7:bc:0c:53:

8e:dd

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Key Usage: critical

Certificate Sign, CRL Sign

X509v3 Extended Key Usage:

TLS Web Client Authentication, TLS Web Server Authentication

X509v3 Basic Constraints: critical

CA:TRUE, pathlen:0

X509v3 Subject Key Identifier:

D6:05:53:D9:86:32:27:48:56:E3:2D:9A:68:C5:EA:E1:20:79:0F:C1

X509v3 Authority Key Identifier:


keyid:A9:A3:DC:1E:01:BE:FF:0B:27:FB:85:3E:02:9E:51:2E:A9:2B:17:04

Authority Information Access:

CA Issuers - URI:http://x1.i.lencr.org/

X509v3 CRL Distribution Points:

Full Name:

URI:http://x1.c.lencr.org/

X509v3 Certificate Policies:

Policy: 2.23.140.1.2.1

Policy: 1.3.6.1.4.1.44947.1.1.1

Signature Algorithm: sha256WithRSAEncryption

c4:d3:1e:e4:e7:ba:96:dc:0e:3d:d3:b2:43:c5:3f:da:7b:c3:

e1:48:8e:c2:bd:9b:bf:2a:37:d8:0b:fb:d8:f4:0e:97:82:17:

92:cc:b5:4c:15:2f:78:56:b3:70:63:21:60:c5:ad:1f:f8:13:

0b:7b:e3:8e:bc:eb:94:cb:69:0b:b9:40:63:03:49:39:2e:ba:

e2:dd:cb:a5:0d:e1:62:05:0c:b2:7a:40:10:cd:c4:5c:dc:e4:

2e:da:5f:37:41:d1:79:03:85:a2:dd:0a:ec:dd:0d:7a:64:fb:

5e:90:bc:4c:6b:95:af:4c:d0:94:e8:b4:ce:33:50:4f:6a:40:

0e:38:94:e3:ed:8e:e1:26:3b:eb:8f:2b:a2:5a:34:64:2f:14:

ed:0f:e7:94:0b:d1:8d:e6:ad:a8:88:4e:f4:27:14:71:b0:d3:

b3:27:19:9d:27:1c:4f:53:c7:c8:3e:90:5b:1b:82:2e:76:bd:

cc:92:c5:e0:22:ec:e0:de:7e:ec:de:f2:02:0d:a1:80:db:f6:

86:47:cd:87:b5:92:bc:63:09:72:e3:23:c7:79:c8:7e:e2:dd:

e1:e1:6a:c6:2e:c1:35:cb:7a:a6:b5:2e:2e:fe:54:99:25:b4:

9f:dc:92:65:a4:ca:bb:54:16:63:ad:d6:6d:11:db:cb:4a:87:

37:50:5a:3e:12:eb:5f:2d:cc:51:07:ef:df:97:da:a5:da:96:

8a:9a:60:bf:fa:b7:68:c0:27:50:f8:83:7e:5c:26:9c:77:4d:

ed:07:4b:be:85:85:40:95:2b:d9:f5:a6:58:c2:fd:28:2e:dc:

06:86:67:70:a2:ad:86:5b:48:c8:d7:55:ba:18:40:b9:57:4d:

f9:6c:00:5d:c2:ab:ec:8e:03:76:d6:9b:0f:ca:de:81:b7:66:

52:5e:9a:17:b6:7b:6a:d1:04:8d:1d:b3:fe:d6:50:a1:60:03:

38:f6:07:ed:70:3d:73:19:bf:ef:1f:c2:dc:b0:70:99:39:ac:

71:91:13:ef:a5:cf:b7:64:a6:5b:29:b9:3d:92:a5:1f:c3:25:

d6:2e:d5:e3:f5:14:70:33:57:38:14:67:5a:23:30:cf:0e:bc:

6c:7a:b3:9e:e9:49:6f:58:b2:10:51:91:32:ee:16:cb:1a:8f:

eb:be:ab:e2:ba:d2:c8:4a:f4:bd:f1:cc:a3:8d:a5:fd:a7:d0:

77:e2:c7:04:a9:47:93:56:42:fc:58:48:32:02:35:40:02:9b:

1d:ae:f7:24:d9:39:01:c5:66:78:60:74:a9:92:fa:07:10:e3:

94:e7:15:ff:63:0d:ad:6d:3c:a4:cf:10:a2:83:e5:f6:7f:56:

ac:83:5c:3d:1f:f0:82:14

```

int-r4.cert.pem.txt

```text

Certificate:

Data:

Version: 3 (0x2)

Serial Number:

25:5e:9c:00:20:eb:9d:1c:29:d2:fb:f1:89:04:77:c1

Signature Algorithm: sha256WithRSAEncryption

Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1

Validity

Not Before: Sep 4 00:00:00 2020 GMT

Not After : Sep 15 16:00:00 2025 GMT

Subject: C = US, O = Let's Encrypt, CN = (FAKE) R4

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public-Key: (2048 bit)

Modulus:

00:d4:c3:84:ce:00:e7:76:34:d5:2a:bb:e4:95:4e:

bc:52:a2:b2:9a:29:9c:56:5b:b9:a4:f0:07:9a:4f:

29:55:7a:97:97:12:78:f8:00:8c:d1:2b:de:6a:0d:

be:d0:5b:b4:74:c3:73:d7:e7:7b:da:bc:1b:72:0d:

30:7c:3a:3b:4f:25:c2:4d:1d:fc:60:21:c7:dd:b9:

a0:e2:fb:65:9f:e9:aa:ed:01:d4:bd:5a:aa:ce:2b:

51:ae:97:39:5d:cc:b2:42:30:40:17:91:3c:8e:d8:

b0:16:b9:16:e0:e8:30:ad:f2:9e:6b:1a:49:a6:9a:

19:6f:bf:41:24:d7:98:bb:6c:85:52:4b:1e:a9:58:

e9:e1:9a:83:4b:a9:14:6a:c3:5d:4c:45:68:30:10:

bd:45:ff:6d:3d:08:fe:88:c5:d6:7d:d1:74:6b:f8:

57:c2:e8:3f:34:42:fa:c2:f4:58:e6:05:88:c7:ea:

e6:17:a2:fd:32:72:4b:a4:2e:6e:85:51:8b:f4:d7:

3e:d3:a7:f9:d9:f5:c6:bc:dd:63:1f:ef:26:b0:98:

b3:a4:b1:f9:b2:b2:9b:9f:34:c8:75:29:e0:88:78:

75:fe:c9:7e:a7:5c:c0:a0:5f:d6:fd:15:0f:3b:0f:

ca:03:3d:b8:50:19:93:a1:74:ac:52:5c:f9:cf:82:

75:89

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Key Usage: critical

Certificate Sign, CRL Sign

X509v3 Extended Key Usage:

TLS Web Client Authentication, TLS Web Server Authentication

X509v3 Basic Constraints: critical

CA:TRUE, pathlen:0

X509v3 Subject Key Identifier:

77:52:2C:3B:1F:BE:4B:22:EB:22:14:21:16:47:40:AA:F9:4C:C5:C4

X509v3 Authority Key Identifier:


keyid:A9:A3:DC:1E:01:BE:FF:0B:27:FB:85:3E:02:9E:51:2E:A9:2B:17:04

Authority Information Access:

CA Issuers - URI:http://x1.i.lencr.org/

X509v3 CRL Distribution Points:

Full Name:

URI:http://x1.c.lencr.org/

X509v3 Certificate Policies:

Policy: 2.23.140.1.2.1

Policy: 1.3.6.1.4.1.44947.1.1.1

Signature Algorithm: sha256WithRSAEncryption

11:e3:c8:53:c6:91:a4:cd:fc:00:6b:ec:12:36:4a:4d:58:43:

c4:60:e4:5e:95:83:f9:dd:2f:f0:34:b5:ed:77:7e:22:7c:db:

a6:e9:a9:fa:40:b2:db:55:14:3a:d6:2e:f8:9a:a4:c3:e9:aa:

bc:69:9d:4c:27:84:fa:e4:b5:61:72:f3:91:58:ce:45:78:9a:

17:32:16:55:f0:a5:1d:89:75:08:11:66:c8:78:fe:71:05:99:

3a:0b:db:11:d9:92:59:45:ff:4c:4b:6b:1c:24:4d:a4:43:f8:

4f:5b:f0:d9:80:c0:56:78:27:8b:94:bd:2c:c1:75:89:65:c0:

04:9f:ba:3f:1b:db:6a:a3:fd:e7:48:8f:49:dc:0d:9f:11:9b:

53:8e:e1:ea:87:81:72:20:16:d2:55:b1:da:13:ed:8c:b3:76:

1f:35:c4:3b:12:1a:29:7d:73:f4:55:1d:06:bd:53:de:6d:a9:

33:73:5c:96:cc:38:1f:66:4e:9b:d4:88:38:33:9c:bb:20:33:

0e:db:2d:a2:03:fa:8f:8a:7e:7c:29:a2:d3:9c:28:d5:31:81:

07:ab:f8:8c:3d:f9:ad:1c:c5:c8:85:86:d8:ad:67:dd:de:e4:

eb:73:18:c0:12:5d:7d:87:b9:ea:ab:25:74:48:39:ba:b5:b8:

04:ea:d1:92:23:96:c7:97:6c:0a:7e:32:f0:76:0d:1a:80:e5:

63:3a:86:86:60:65:8c:61:f1:cd:a1:61:f7:7e:80:92:dd:44:

92:e7:82:0f:1b:d9:61:ea:f9:92:f2:65:dd:40:1f:c8:a1:2a:

f5:55:95:f4:29:85:fa:ad:03:24:e9:09:39:80:b0:05:b8:9b:

a3:59:b8:52:b9:4a:ef:9f:59:e3:57:72:29:fe:3e:bd:46:55:

19:af:5d:61:96:7d:be:ce:1f:e0:aa:51:8f:c8:dc:27:10:a8:

aa:d6:61:41:fc:3e:e4:cb:86:54:0a:4b:60:f6:27:18:b5:70:

17:94:b7:00:07:6d:6b:95:db:e4:28:8a:fa:5e:9c:76:a3:a5:

45:7d:9d:ca:4b:c6:2f:84:91:7a:09:7a:8c:8a:db:b5:20:10:

cf:7f:7a:90:48:8d:6e:47:a4:03:d4:19:65:49:a5:96:49:e9:

e2:1d:af:a1:e2:5e:a0:4c:25:39:c3:8c:b6:01:1c:4b:3b:be:

41:6b:4d:28:b0:e3:fc:01:a7:e8:0e:f1:38:2e:3c:a3:25:e2:

c7:83:4c:4b:f8:95:98:91:08:ae:90:56:48:db:96:69:57:44:

5a:4d:b8:42:3e:5e:38:f3:3f:73:02:b9:44:7d:0f:71:fd:56:

70:1c:da:04:9f:8b:20:ce

```

Jacob Hoffman-Andrews

unread,
Sep 1, 2020, 5:02:56 PM9/1/20
to dev-secur...@lists.mozilla.org
Update on this: Thanks to the excellent zmap/zlint tool, we realized we
were missing the digitalSignature keyUsage on our planned new
intermediates. We've updated the demo repo and our forum post (
https://community.letsencrypt.org/t/detailed-2020-hierarchy/131019) to
indicate that we plan to include digitalSignature on these intermediates,
so we can sign OCSP directly from them.
Reply all
Reply to author
Forward
0 new messages