Plans for new ECDSA root and new intermediates from Let's Encrypt
517 views
Skip to first unread message
Jacob Hoffman-Andrews
Aug 25, 2020, 12:40:33 PM8/25/20
to dev-secur...@lists.mozilla.org
Let’s Encrypt is planning to issue a new root and new intermediates soon.
The new root will be an ECDSA one, to augment our existing RSA root. The
new intermediates will be part of our regular replacement of intermediates.
Our RSA root will cross-sign the ECDSA root.
We’re sharing our detailed issuance plans, including certificate profiles
and the tools we will use to generate the certificates. This is in the
spirit of transparency and also to get feedback from the community about
our plans.
Originally posted at
https://community.letsencrypt.org/t/detailed-2020-hierarchy/131019:
I’ve put together a detailed demonstration at
https://github.com/letsencrypt/2020-hierarchy-demo. I’ve attached sample
output from a run here, along with OpenSSL textual output. If you see any
flaws, please let us know!
Notable things:
-
We’re continuing to use X1 / X2 to identify roots.
-
We’re using O=Let’s Encrypt, CN=E1, E2, R3, and R4 to identify
intermediates, where E/R indicates the key type, and we chose
non-overlapping numbers across key types to make the names even easier to
visually distinguish.
-
We’re using P-384 for our ECDSA hierarchy. We will continue to issue
both P-256 and P-384 end-entity (leaf) certificates.
-
Per Ballot SC31 <https://github.com/cabforum/documents/pull/195>, we are
not including OCSP URLs in our intermediates. This makes them smaller (for
faster handshakes) and also simplifies our operations. The ballot has
passed. We plan to perform the ceremony after the ballot’s review period
has also passed and it takes effect.
-
We’re adopting a new domain for URLs in certificates: lencr.org. This
saves some bytes.
-
For intermediates, we are just including CPS OIDs, not CPS URLs. Our
end-entity certificates contain our CPS URL, so including it in the
intermediates uses bytes unnecessarily.
The below is sample output from our demonstration:
root-x2.cert.pem.txt:
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
0d:e3:b6:d6:c3:12:af:10:9c:8b:74:de:8b:3a:97:a0
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 17 16:00:00 2040 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root
X2
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:aa:a9:a7:6e:c0:cd:01:16:af:60:ba:35:ea:d9:
02:8e:fb:ec:b8:c9:9f:a6:5c:50:f4:fc:25:99:af:
76:4c:22:50:8d:62:86:1d:51:58:b9:2d:39:dc:1a:
ca:76:1d:44:83:6c:93:94:01:b1:e3:9c:27:d6:e8:
61:ac:ab:bc:7f:4e:7f:d9:8a:43:d5:57:dd:72:87:
70:1c:25:c7:41:78:ad:ce:58:86:79:61:ff:ee:a3:
2b:9c:c3:5f:9d:b7:36
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
Signature Algorithm: ecdsa-with-SHA384
30:65:02:31:00:d2:6c:91:04:a7:d6:21:73:d0:52:f1:68:eb:
4b:34:98:9a:43:57:9d:fe:d2:61:fc:c0:c1:ec:5f:58:f6:c9:
b9:ea:84:3e:1f:3a:20:e4:85:dd:72:36:00:53:1e:30:88:02:
30:02:25:a3:c4:ac:6e:97:70:6f:b3:cd:4f:59:95:55:b9:e7:
52:f1:4d:a6:a0:a3:07:77:40:d4:dc:05:7b:26:9e:b9:be:05:
b9:0f:c0:5f:9e:cc:3a:1c:de:e7:8b:2b:93
```
x2-signed-by-x1.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
07:d7:a2:bb:0c:dc:93:25:d0:be:e2:26:39:de:7b:d0
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root
X2
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:77:df:ec:6c:fe:22:06:aa:2e:8f:54:ce:1d:30:
60:01:85:ca:92:d6:d6:3d:21:0f:e5:18:1b:d5:35:
a4:72:ad:2d:07:56:cc:fe:0c:f5:39:2b:da:1a:83:
bf:a2:1a:9d:96:a2:74:2d:01:84:32:30:35:e0:a1:
e4:8a:fe:7f:16:58:83:13:e2:49:f2:01:84:60:98:
ef:07:4f:3c:f6:0c:86:21:22:33:aa:4e:6d:45:01:
da:8b:98:fb:c8:db:a5
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
55:49:E8:C3:B7:0B:25:64:96:86:E3:F8:0D:E3:F3:4B:34:9E:23:84
X509v3 Authority Key Identifier:
keyid:B3:89:A4:0B:1C:64:C4:E7:E7:00:5B:CA:02:D5:8C:16:D7:77:D0:F9
Authority Information Access:
CA Issuers - URI:http://x1.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x1.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: sha256WithRSAEncryption
76:d6:43:74:4d:4f:8c:67:dc:12:d3:e4:0e:06:97:a9:66:42:
a7:e9:d2:33:b5:1f:75:c1:4a:12:1d:8a:8d:ef:cd:2f:12:59:
1b:b1:c1:1b:ee:60:11:2f:ea:41:16:35:cc:12:ac:2e:7a:d2:
78:dd:dd:66:40:c9:18:cb:b4:a3:79:8e:98:91:7b:46:8d:c7:
e7:d1:d5:1c:e8:72:d2:3b:b2:05:b4:52:97:d7:72:9b:fc:bd:
b5:1c:f1:3c:b0:f8:70:16:21:2d:10:73:a0:14:0a:92:77:39:
3f:85:11:26:29:1a:06:b3:2f:79:36:28:54:6a:de:f7:65:a2:
07:1a:5c:64:c6:1a:23:97:9e:2c:58:7e:bc:45:22:3b:d2:e4:
23:f6:92:a5:5e:a8:11:f1:1a:ed:2f:3a:bf:81:a0:de:c4:5c:
00:83:31:54:95:65:cb:07:95:53:95:62:af:48:b4:e1:09:aa:
a3:73:86:a6:a0:14:c5:fd:0a:d0:05:16:22:e4:93:ec:75:3b:
d5:c1:78:68:7a:12:b8:00:29:5b:c4:6f:73:aa:05:d7:0f:ab:
a2:a0:25:1d:7c:e3:77:9b:24:01:a7:58:c2:b7:e7:6d:fd:9c:
db:b9:e1:19:c4:34:b2:f0:30:a8:c7:fa:97:14:fd:57:c9:e0:
5e:b0:aa:b4:ab:7f:bd:03:b2:4f:12:05:45:10:4d:78:74:13:
89:e8:5a:e3:45:03:74:96:13:ff:9b:81:f3:21:45:0b:d6:ec:
e6:8f:dc:96:f0:88:1b:67:32:11:f4:45:2c:e2:e4:2d:ff:6c:
79:bc:fa:e0:39:e0:44:d5:02:86:3b:d5:0b:4f:a3:35:29:9a:
ab:66:ff:8b:1b:37:1f:de:be:89:7e:25:67:64:8c:4c:1d:0f:
d6:8d:de:2a:a2:f5:3f:eb:5f:c9:89:db:6d:5a:3a:90:83:fb:
6d:31:40:a1:82:f8:3b:b0:5a:75:8d:32:fb:26:59:90:73:a0:
fa:8a:e7:50:c1:87:8c:50:01:ba:20:f4:b9:fa:2d:66:8b:fc:
b9:b4:d3:bc:e9:64:24:fa:4b:9f:cc:3d:ab:d7:b2:d3:a7:5e:
c8:de:13:ac:5c:2d:68:ec:4b:9f:8c:0b:24:ee:39:6f:34:45:
80:7f:9a:16:be:b8:10:e7:42:fb:1e:81:33:3e:6f:98:68:6d:
83:93:09:92:1e:73:50:77:92:04:5b:76:56:9a:ac:20:aa:39:
87:18:76:f9:6a:b5:61:dc:5e:eb:2c:8c:c1:b9:0a:7f:27:77:
d9:ad:e6:99:d6:ff:06:2f:47:e3:cf:00:9e:33:1d:ff:61:51:
db:66:a4:9c:fe:54:39:e5
```
root-x2.crl.pem.txt
```text
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Last Update: Sep 4 00:00:00 2020 GMT
Next Update: Aug 4 00:00:00 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
X509v3 CRL Number:
100
No Revoked Certificates.
Signature Algorithm: ecdsa-with-SHA384
30:65:02:31:00:f2:ff:1c:52:20:ef:9d:1c:6d:74:95:10:47:
44:66:05:e1:10:5f:1e:72:a2:10:4a:19:25:fd:94:be:1b:17:
c8:f6:a5:30:07:88:db:8b:92:dd:be:08:f1:f5:34:67:73:02:
30:74:e1:4e:86:9e:ef:1f:7b:14:91:01:fe:d7:7b:0b:11:b7:
4b:cb:d1:f4:ad:12:37:e6:c5:8f:00:fa:8f:35:15:e0:ac:93:
77:45:80:e5:c9:46:17:81:4a:71:d0:a6:0b
```
int-e1.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
9b:51:80:12:58:e4:c1:87:4a:42:99:4f:30:69:3f:dd
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) E1
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:42:03:f9:9f:d0:6c:9f:a4:80:5a:29:f4:e1:63:
6c:87:d0:ec:cf:f4:ef:a9:ed:51:75:e4:c7:d7:fa:
aa:89:b6:40:ef:f4:8e:85:af:02:b3:2d:57:e9:eb:
55:9c:03:bd:6e:9c:1d:0d:72:01:10:54:c0:5f:a9:
34:fe:6e:fe:15:e4:7c:67:c5:94:6b:52:42:10:67:
21:52:0c:b7:a5:63:df:1f:e1:87:5f:d7:fd:30:be:
d6:11:df:65:03:22:4e
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
41:C5:56:06:07:79:77:7B:4B:12:0C:52:00:79:FD:73:E2:F9:7E:E7
X509v3 Authority Key Identifier:
keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
Authority Information Access:
CA Issuers - URI:http://x2.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x2.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: ecdsa-with-SHA384
30:65:02:30:4a:89:e2:09:c5:0e:fc:bb:6c:4f:9f:86:e0:35:
8f:f1:53:d3:c0:5f:c1:2e:98:52:b3:45:c6:3f:56:b4:b4:bb:
f7:5e:c4:1d:05:5e:10:95:c5:ee:46:c6:11:88:e3:53:02:31:
00:f8:b6:31:d2:c4:47:28:52:b4:84:84:9c:37:0d:56:64:89:
bd:cb:80:6b:16:db:8c:54:f8:e1:74:f5:c3:e7:99:cf:4f:66:
99:b4:60:a3:44:2b:d0:88:85:18:9b:fe:6b
```
int-e2.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
55:16:37:77:f4:32:11:39:63:1d:ac:6c:59:2f:e3:4d
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) E2
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:b8:f3:3c:11:cf:55:8d:cd:d8:7e:db:1e:91:1f:
3e:0f:53:e4:ff:35:69:b7:9d:5c:cb:5a:ec:69:4c:
7f:64:c9:46:d0:95:0a:4e:e0:04:06:17:a7:25:bc:
a5:34:03:43:ca:47:3d:65:65:3e:9c:0a:7d:66:57:
77:e9:fa:24:ae:57:49:7b:5e:88:5c:ab:6d:67:e1:
b1:23:92:0d:c1:05:d7:3b:31:90:45:9f:d6:97:0c:
03:24:73:ad:2d:f9:76
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
E9:BE:44:E8:A5:D6:BE:35:7F:7E:93:02:72:6E:C6:D7:4B:43:F6:E3
X509v3 Authority Key Identifier:
keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
Authority Information Access:
CA Issuers - URI:http://x2.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x2.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: ecdsa-with-SHA384
30:65:02:30:0e:ef:00:95:54:e2:36:9c:f2:7a:2b:a5:98:4d:
d9:fc:d4:85:b6:31:75:3c:25:02:bb:91:33:93:9c:dc:14:5f:
a6:16:a0:1b:e7:e4:53:01:76:f7:60:cc:74:9a:45:8c:02:31:
00:e8:c5:d0:1e:d7:11:25:13:f1:ad:3b:b1:75:48:56:d3:bb:
9c:e3:54:72:33:0f:bd:b1:47:f3:88:49:74:74:65:cf:f3:d6:
73:54:ef:80:76:a2:fa:f0:9d:4c:01:1a:51
```
int-r3.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
99:84:df:97:40:a4:ee:80:26:4b:91:37:38:4c:54:f0
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) R3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:ad:4a:7e:29:b0:40:3f:5d:02:2a:e6:a0:61:36:
b5:53:da:9b:43:a9:a8:cc:77:cc:b3:42:1f:2c:45:
e5:be:ed:82:44:64:fa:f6:11:0b:55:b1:94:cb:c4:
ed:65:bd:80:cb:42:f6:10:53:42:bb:cd:d6:53:b1:
11:25:fc:87:63:e0:fa:17:92:a7:f0:11:a0:93:14:
51:94:c3:00:17:3d:57:43:84:c7:6a:28:0c:bf:b7:
ea:93:43:c1:55:f9:93:e8:b1:1d:99:de:8a:c1:ad:
51:73:f7:fe:a1:35:c1:d2:08:56:25:59:d7:e8:e4:
ca:a8:cc:e1:58:d7:d7:47:75:76:06:da:8a:1c:59:
75:e9:33:50:33:cb:8c:30:f3:c3:b4:85:e2:7d:64:
11:e0:61:b8:6c:52:37:97:d8:7f:f5:68:78:01:a2:
45:3b:6c:6d:01:5e:e4:da:db:a6:72:30:71:12:8d:
25:d0:3f:6f:ab:c7:bf:f2:90:0c:76:7e:d7:26:c6:
76:e7:f1:6c:b0:4b:50:46:c6:a5:ef:e3:80:5c:b7:
bc:6e:86:51:ee:a5:6f:bc:95:11:6b:63:74:07:54:
b5:6b:47:cc:05:83:9e:c6:64:ed:e6:2a:77:33:d9:
9f:1b:f3:6b:26:60:77:84:6c:c1:23:c7:bc:0c:53:
8e:dd
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
D6:05:53:D9:86:32:27:48:56:E3:2D:9A:68:C5:EA:E1:20:79:0F:C1
X509v3 Authority Key Identifier:
keyid:A9:A3:DC:1E:01:BE:FF:0B:27:FB:85:3E:02:9E:51:2E:A9:2B:17:04
Authority Information Access:
CA Issuers - URI:http://x1.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x1.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: sha256WithRSAEncryption
c4:d3:1e:e4:e7:ba:96:dc:0e:3d:d3:b2:43:c5:3f:da:7b:c3:
e1:48:8e:c2:bd:9b:bf:2a:37:d8:0b:fb:d8:f4:0e:97:82:17:
92:cc:b5:4c:15:2f:78:56:b3:70:63:21:60:c5:ad:1f:f8:13:
0b:7b:e3:8e:bc:eb:94:cb:69:0b:b9:40:63:03:49:39:2e:ba:
e2:dd:cb:a5:0d:e1:62:05:0c:b2:7a:40:10:cd:c4:5c:dc:e4:
2e:da:5f:37:41:d1:79:03:85:a2:dd:0a:ec:dd:0d:7a:64:fb:
5e:90:bc:4c:6b:95:af:4c:d0:94:e8:b4:ce:33:50:4f:6a:40:
0e:38:94:e3:ed:8e:e1:26:3b:eb:8f:2b:a2:5a:34:64:2f:14:
ed:0f:e7:94:0b:d1:8d:e6:ad:a8:88:4e:f4:27:14:71:b0:d3:
b3:27:19:9d:27:1c:4f:53:c7:c8:3e:90:5b:1b:82:2e:76:bd:
cc:92:c5:e0:22:ec:e0:de:7e:ec:de:f2:02:0d:a1:80:db:f6:
86:47:cd:87:b5:92:bc:63:09:72:e3:23:c7:79:c8:7e:e2:dd:
e1:e1:6a:c6:2e:c1:35:cb:7a:a6:b5:2e:2e:fe:54:99:25:b4:
9f:dc:92:65:a4:ca:bb:54:16:63:ad:d6:6d:11:db:cb:4a:87:
37:50:5a:3e:12:eb:5f:2d:cc:51:07:ef:df:97:da:a5:da:96:
8a:9a:60:bf:fa:b7:68:c0:27:50:f8:83:7e:5c:26:9c:77:4d:
ed:07:4b:be:85:85:40:95:2b:d9:f5:a6:58:c2:fd:28:2e:dc:
06:86:67:70:a2:ad:86:5b:48:c8:d7:55:ba:18:40:b9:57:4d:
f9:6c:00:5d:c2:ab:ec:8e:03:76:d6:9b:0f:ca:de:81:b7:66:
52:5e:9a:17:b6:7b:6a:d1:04:8d:1d:b3:fe:d6:50:a1:60:03:
38:f6:07:ed:70:3d:73:19:bf:ef:1f:c2:dc:b0:70:99:39:ac:
71:91:13:ef:a5:cf:b7:64:a6:5b:29:b9:3d:92:a5:1f:c3:25:
d6:2e:d5:e3:f5:14:70:33:57:38:14:67:5a:23:30:cf:0e:bc:
6c:7a:b3:9e:e9:49:6f:58:b2:10:51:91:32:ee:16:cb:1a:8f:
eb:be:ab:e2:ba:d2:c8:4a:f4:bd:f1:cc:a3:8d:a5:fd:a7:d0:
77:e2:c7:04:a9:47:93:56:42:fc:58:48:32:02:35:40:02:9b:
1d:ae:f7:24:d9:39:01:c5:66:78:60:74:a9:92:fa:07:10:e3:
94:e7:15:ff:63:0d:ad:6d:3c:a4:cf:10:a2:83:e5:f6:7f:56:
ac:83:5c:3d:1f:f0:82:14
```
int-r4.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
25:5e:9c:00:20:eb:9d:1c:29:d2:fb:f1:89:04:77:c1
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) R4
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:d4:c3:84:ce:00:e7:76:34:d5:2a:bb:e4:95:4e:
bc:52:a2:b2:9a:29:9c:56:5b:b9:a4:f0:07:9a:4f:
29:55:7a:97:97:12:78:f8:00:8c:d1:2b:de:6a:0d:
be:d0:5b:b4:74:c3:73:d7:e7:7b:da:bc:1b:72:0d:
30:7c:3a:3b:4f:25:c2:4d:1d:fc:60:21:c7:dd:b9:
a0:e2:fb:65:9f:e9:aa:ed:01:d4:bd:5a:aa:ce:2b:
51:ae:97:39:5d:cc:b2:42:30:40:17:91:3c:8e:d8:
b0:16:b9:16:e0:e8:30:ad:f2:9e:6b:1a:49:a6:9a:
19:6f:bf:41:24:d7:98:bb:6c:85:52:4b:1e:a9:58:
e9:e1:9a:83:4b:a9:14:6a:c3:5d:4c:45:68:30:10:
bd:45:ff:6d:3d:08:fe:88:c5:d6:7d:d1:74:6b:f8:
57:c2:e8:3f:34:42:fa:c2:f4:58:e6:05:88:c7:ea:
e6:17:a2:fd:32:72:4b:a4:2e:6e:85:51:8b:f4:d7:
3e:d3:a7:f9:d9:f5:c6:bc:dd:63:1f:ef:26:b0:98:
b3:a4:b1:f9:b2:b2:9b:9f:34:c8:75:29:e0:88:78:
75:fe:c9:7e:a7:5c:c0:a0:5f:d6:fd:15:0f:3b:0f:
ca:03:3d:b8:50:19:93:a1:74:ac:52:5c:f9:cf:82:
75:89
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
77:52:2C:3B:1F:BE:4B:22:EB:22:14:21:16:47:40:AA:F9:4C:C5:C4
X509v3 Authority Key Identifier:
keyid:A9:A3:DC:1E:01:BE:FF:0B:27:FB:85:3E:02:9E:51:2E:A9:2B:17:04
Authority Information Access:
CA Issuers - URI:http://x1.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x1.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: sha256WithRSAEncryption
11:e3:c8:53:c6:91:a4:cd:fc:00:6b:ec:12:36:4a:4d:58:43:
c4:60:e4:5e:95:83:f9:dd:2f:f0:34:b5:ed:77:7e:22:7c:db:
a6:e9:a9:fa:40:b2:db:55:14:3a:d6:2e:f8:9a:a4:c3:e9:aa:
bc:69:9d:4c:27:84:fa:e4:b5:61:72:f3:91:58:ce:45:78:9a:
17:32:16:55:f0:a5:1d:89:75:08:11:66:c8:78:fe:71:05:99:
3a:0b:db:11:d9:92:59:45:ff:4c:4b:6b:1c:24:4d:a4:43:f8:
4f:5b:f0:d9:80:c0:56:78:27:8b:94:bd:2c:c1:75:89:65:c0:
04:9f:ba:3f:1b:db:6a:a3:fd:e7:48:8f:49:dc:0d:9f:11:9b:
53:8e:e1:ea:87:81:72:20:16:d2:55:b1:da:13:ed:8c:b3:76:
1f:35:c4:3b:12:1a:29:7d:73:f4:55:1d:06:bd:53:de:6d:a9:
33:73:5c:96:cc:38:1f:66:4e:9b:d4:88:38:33:9c:bb:20:33:
0e:db:2d:a2:03:fa:8f:8a:7e:7c:29:a2:d3:9c:28:d5:31:81:
07:ab:f8:8c:3d:f9:ad:1c:c5:c8:85:86:d8:ad:67:dd:de:e4:
eb:73:18:c0:12:5d:7d:87:b9:ea:ab:25:74:48:39:ba:b5:b8:
04:ea:d1:92:23:96:c7:97:6c:0a:7e:32:f0:76:0d:1a:80:e5:
63:3a:86:86:60:65:8c:61:f1:cd:a1:61:f7:7e:80:92:dd:44:
92:e7:82:0f:1b:d9:61:ea:f9:92:f2:65:dd:40:1f:c8:a1:2a:
f5:55:95:f4:29:85:fa:ad:03:24:e9:09:39:80:b0:05:b8:9b:
a3:59:b8:52:b9:4a:ef:9f:59:e3:57:72:29:fe:3e:bd:46:55:
19:af:5d:61:96:7d:be:ce:1f:e0:aa:51:8f:c8:dc:27:10:a8:
aa:d6:61:41:fc:3e:e4:cb:86:54:0a:4b:60:f6:27:18:b5:70:
17:94:b7:00:07:6d:6b:95:db:e4:28:8a:fa:5e:9c:76:a3:a5:
45:7d:9d:ca:4b:c6:2f:84:91:7a:09:7a:8c:8a:db:b5:20:10:
cf:7f:7a:90:48:8d:6e:47:a4:03:d4:19:65:49:a5:96:49:e9:
e2:1d:af:a1:e2:5e:a0:4c:25:39:c3:8c:b6:01:1c:4b:3b:be:
41:6b:4d:28:b0:e3:fc:01:a7:e8:0e:f1:38:2e:3c:a3:25:e2:
c7:83:4c:4b:f8:95:98:91:08:ae:90:56:48:db:96:69:57:44:
5a:4d:b8:42:3e:5e:38:f3:3f:73:02:b9:44:7d:0f:71:fd:56:
70:1c:da:04:9f:8b:20:ce
```
The new root will be an ECDSA one, to augment our existing RSA root. The
new intermediates will be part of our regular replacement of intermediates.
Our RSA root will cross-sign the ECDSA root.
We’re sharing our detailed issuance plans, including certificate profiles
and the tools we will use to generate the certificates. This is in the
spirit of transparency and also to get feedback from the community about
our plans.
Originally posted at
https://community.letsencrypt.org/t/detailed-2020-hierarchy/131019:
I’ve put together a detailed demonstration at
https://github.com/letsencrypt/2020-hierarchy-demo. I’ve attached sample
output from a run here, along with OpenSSL textual output. If you see any
flaws, please let us know!
Notable things:
-
We’re continuing to use X1 / X2 to identify roots.
-
We’re using O=Let’s Encrypt, CN=E1, E2, R3, and R4 to identify
intermediates, where E/R indicates the key type, and we chose
non-overlapping numbers across key types to make the names even easier to
visually distinguish.
-
We’re using P-384 for our ECDSA hierarchy. We will continue to issue
both P-256 and P-384 end-entity (leaf) certificates.
-
Per Ballot SC31 <https://github.com/cabforum/documents/pull/195>, we are
not including OCSP URLs in our intermediates. This makes them smaller (for
faster handshakes) and also simplifies our operations. The ballot has
passed. We plan to perform the ceremony after the ballot’s review period
has also passed and it takes effect.
-
We’re adopting a new domain for URLs in certificates: lencr.org. This
saves some bytes.
-
For intermediates, we are just including CPS OIDs, not CPS URLs. Our
end-entity certificates contain our CPS URL, so including it in the
intermediates uses bytes unnecessarily.
The below is sample output from our demonstration:
root-x2.cert.pem.txt:
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
0d:e3:b6:d6:c3:12:af:10:9c:8b:74:de:8b:3a:97:a0
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 17 16:00:00 2040 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root
X2
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:aa:a9:a7:6e:c0:cd:01:16:af:60:ba:35:ea:d9:
02:8e:fb:ec:b8:c9:9f:a6:5c:50:f4:fc:25:99:af:
76:4c:22:50:8d:62:86:1d:51:58:b9:2d:39:dc:1a:
ca:76:1d:44:83:6c:93:94:01:b1:e3:9c:27:d6:e8:
61:ac:ab:bc:7f:4e:7f:d9:8a:43:d5:57:dd:72:87:
70:1c:25:c7:41:78:ad:ce:58:86:79:61:ff:ee:a3:
2b:9c:c3:5f:9d:b7:36
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
Signature Algorithm: ecdsa-with-SHA384
30:65:02:31:00:d2:6c:91:04:a7:d6:21:73:d0:52:f1:68:eb:
4b:34:98:9a:43:57:9d:fe:d2:61:fc:c0:c1:ec:5f:58:f6:c9:
b9:ea:84:3e:1f:3a:20:e4:85:dd:72:36:00:53:1e:30:88:02:
30:02:25:a3:c4:ac:6e:97:70:6f:b3:cd:4f:59:95:55:b9:e7:
52:f1:4d:a6:a0:a3:07:77:40:d4:dc:05:7b:26:9e:b9:be:05:
b9:0f:c0:5f:9e:cc:3a:1c:de:e7:8b:2b:93
```
x2-signed-by-x1.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
07:d7:a2:bb:0c:dc:93:25:d0:be:e2:26:39:de:7b:d0
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root
X2
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:77:df:ec:6c:fe:22:06:aa:2e:8f:54:ce:1d:30:
60:01:85:ca:92:d6:d6:3d:21:0f:e5:18:1b:d5:35:
a4:72:ad:2d:07:56:cc:fe:0c:f5:39:2b:da:1a:83:
bf:a2:1a:9d:96:a2:74:2d:01:84:32:30:35:e0:a1:
e4:8a:fe:7f:16:58:83:13:e2:49:f2:01:84:60:98:
ef:07:4f:3c:f6:0c:86:21:22:33:aa:4e:6d:45:01:
da:8b:98:fb:c8:db:a5
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
55:49:E8:C3:B7:0B:25:64:96:86:E3:F8:0D:E3:F3:4B:34:9E:23:84
X509v3 Authority Key Identifier:
keyid:B3:89:A4:0B:1C:64:C4:E7:E7:00:5B:CA:02:D5:8C:16:D7:77:D0:F9
Authority Information Access:
CA Issuers - URI:http://x1.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x1.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: sha256WithRSAEncryption
76:d6:43:74:4d:4f:8c:67:dc:12:d3:e4:0e:06:97:a9:66:42:
a7:e9:d2:33:b5:1f:75:c1:4a:12:1d:8a:8d:ef:cd:2f:12:59:
1b:b1:c1:1b:ee:60:11:2f:ea:41:16:35:cc:12:ac:2e:7a:d2:
78:dd:dd:66:40:c9:18:cb:b4:a3:79:8e:98:91:7b:46:8d:c7:
e7:d1:d5:1c:e8:72:d2:3b:b2:05:b4:52:97:d7:72:9b:fc:bd:
b5:1c:f1:3c:b0:f8:70:16:21:2d:10:73:a0:14:0a:92:77:39:
3f:85:11:26:29:1a:06:b3:2f:79:36:28:54:6a:de:f7:65:a2:
07:1a:5c:64:c6:1a:23:97:9e:2c:58:7e:bc:45:22:3b:d2:e4:
23:f6:92:a5:5e:a8:11:f1:1a:ed:2f:3a:bf:81:a0:de:c4:5c:
00:83:31:54:95:65:cb:07:95:53:95:62:af:48:b4:e1:09:aa:
a3:73:86:a6:a0:14:c5:fd:0a:d0:05:16:22:e4:93:ec:75:3b:
d5:c1:78:68:7a:12:b8:00:29:5b:c4:6f:73:aa:05:d7:0f:ab:
a2:a0:25:1d:7c:e3:77:9b:24:01:a7:58:c2:b7:e7:6d:fd:9c:
db:b9:e1:19:c4:34:b2:f0:30:a8:c7:fa:97:14:fd:57:c9:e0:
5e:b0:aa:b4:ab:7f:bd:03:b2:4f:12:05:45:10:4d:78:74:13:
89:e8:5a:e3:45:03:74:96:13:ff:9b:81:f3:21:45:0b:d6:ec:
e6:8f:dc:96:f0:88:1b:67:32:11:f4:45:2c:e2:e4:2d:ff:6c:
79:bc:fa:e0:39:e0:44:d5:02:86:3b:d5:0b:4f:a3:35:29:9a:
ab:66:ff:8b:1b:37:1f:de:be:89:7e:25:67:64:8c:4c:1d:0f:
d6:8d:de:2a:a2:f5:3f:eb:5f:c9:89:db:6d:5a:3a:90:83:fb:
6d:31:40:a1:82:f8:3b:b0:5a:75:8d:32:fb:26:59:90:73:a0:
fa:8a:e7:50:c1:87:8c:50:01:ba:20:f4:b9:fa:2d:66:8b:fc:
b9:b4:d3:bc:e9:64:24:fa:4b:9f:cc:3d:ab:d7:b2:d3:a7:5e:
c8:de:13:ac:5c:2d:68:ec:4b:9f:8c:0b:24:ee:39:6f:34:45:
80:7f:9a:16:be:b8:10:e7:42:fb:1e:81:33:3e:6f:98:68:6d:
83:93:09:92:1e:73:50:77:92:04:5b:76:56:9a:ac:20:aa:39:
87:18:76:f9:6a:b5:61:dc:5e:eb:2c:8c:c1:b9:0a:7f:27:77:
d9:ad:e6:99:d6:ff:06:2f:47:e3:cf:00:9e:33:1d:ff:61:51:
db:66:a4:9c:fe:54:39:e5
```
root-x2.crl.pem.txt
```text
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Last Update: Sep 4 00:00:00 2020 GMT
Next Update: Aug 4 00:00:00 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
X509v3 CRL Number:
100
No Revoked Certificates.
Signature Algorithm: ecdsa-with-SHA384
30:65:02:31:00:f2:ff:1c:52:20:ef:9d:1c:6d:74:95:10:47:
44:66:05:e1:10:5f:1e:72:a2:10:4a:19:25:fd:94:be:1b:17:
c8:f6:a5:30:07:88:db:8b:92:dd:be:08:f1:f5:34:67:73:02:
30:74:e1:4e:86:9e:ef:1f:7b:14:91:01:fe:d7:7b:0b:11:b7:
4b:cb:d1:f4:ad:12:37:e6:c5:8f:00:fa:8f:35:15:e0:ac:93:
77:45:80:e5:c9:46:17:81:4a:71:d0:a6:0b
```
int-e1.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
9b:51:80:12:58:e4:c1:87:4a:42:99:4f:30:69:3f:dd
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) E1
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:42:03:f9:9f:d0:6c:9f:a4:80:5a:29:f4:e1:63:
6c:87:d0:ec:cf:f4:ef:a9:ed:51:75:e4:c7:d7:fa:
aa:89:b6:40:ef:f4:8e:85:af:02:b3:2d:57:e9:eb:
55:9c:03:bd:6e:9c:1d:0d:72:01:10:54:c0:5f:a9:
34:fe:6e:fe:15:e4:7c:67:c5:94:6b:52:42:10:67:
21:52:0c:b7:a5:63:df:1f:e1:87:5f:d7:fd:30:be:
d6:11:df:65:03:22:4e
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
41:C5:56:06:07:79:77:7B:4B:12:0C:52:00:79:FD:73:E2:F9:7E:E7
X509v3 Authority Key Identifier:
keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
Authority Information Access:
CA Issuers - URI:http://x2.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x2.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: ecdsa-with-SHA384
30:65:02:30:4a:89:e2:09:c5:0e:fc:bb:6c:4f:9f:86:e0:35:
8f:f1:53:d3:c0:5f:c1:2e:98:52:b3:45:c6:3f:56:b4:b4:bb:
f7:5e:c4:1d:05:5e:10:95:c5:ee:46:c6:11:88:e3:53:02:31:
00:f8:b6:31:d2:c4:47:28:52:b4:84:84:9c:37:0d:56:64:89:
bd:cb:80:6b:16:db:8c:54:f8:e1:74:f5:c3:e7:99:cf:4f:66:
99:b4:60:a3:44:2b:d0:88:85:18:9b:fe:6b
```
int-e2.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
55:16:37:77:f4:32:11:39:63:1d:ac:6c:59:2f:e3:4d
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = (FAKE) Let's Encrypt Root X2
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) E2
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (384 bit)
pub:
04:b8:f3:3c:11:cf:55:8d:cd:d8:7e:db:1e:91:1f:
3e:0f:53:e4:ff:35:69:b7:9d:5c:cb:5a:ec:69:4c:
7f:64:c9:46:d0:95:0a:4e:e0:04:06:17:a7:25:bc:
a5:34:03:43:ca:47:3d:65:65:3e:9c:0a:7d:66:57:
77:e9:fa:24:ae:57:49:7b:5e:88:5c:ab:6d:67:e1:
b1:23:92:0d:c1:05:d7:3b:31:90:45:9f:d6:97:0c:
03:24:73:ad:2d:f9:76
ASN1 OID: secp384r1
NIST CURVE: P-384
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
E9:BE:44:E8:A5:D6:BE:35:7F:7E:93:02:72:6E:C6:D7:4B:43:F6:E3
X509v3 Authority Key Identifier:
keyid:5B:BC:E1:46:F2:7B:A4:61:96:FA:28:A8:23:10:F5:BD:C2:CA:8F:E0
Authority Information Access:
CA Issuers - URI:http://x2.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x2.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: ecdsa-with-SHA384
30:65:02:30:0e:ef:00:95:54:e2:36:9c:f2:7a:2b:a5:98:4d:
d9:fc:d4:85:b6:31:75:3c:25:02:bb:91:33:93:9c:dc:14:5f:
a6:16:a0:1b:e7:e4:53:01:76:f7:60:cc:74:9a:45:8c:02:31:
00:e8:c5:d0:1e:d7:11:25:13:f1:ad:3b:b1:75:48:56:d3:bb:
9c:e3:54:72:33:0f:bd:b1:47:f3:88:49:74:74:65:cf:f3:d6:
73:54:ef:80:76:a2:fa:f0:9d:4c:01:1a:51
```
int-r3.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
99:84:df:97:40:a4:ee:80:26:4b:91:37:38:4c:54:f0
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) R3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:ad:4a:7e:29:b0:40:3f:5d:02:2a:e6:a0:61:36:
b5:53:da:9b:43:a9:a8:cc:77:cc:b3:42:1f:2c:45:
e5:be:ed:82:44:64:fa:f6:11:0b:55:b1:94:cb:c4:
ed:65:bd:80:cb:42:f6:10:53:42:bb:cd:d6:53:b1:
11:25:fc:87:63:e0:fa:17:92:a7:f0:11:a0:93:14:
51:94:c3:00:17:3d:57:43:84:c7:6a:28:0c:bf:b7:
ea:93:43:c1:55:f9:93:e8:b1:1d:99:de:8a:c1:ad:
51:73:f7:fe:a1:35:c1:d2:08:56:25:59:d7:e8:e4:
ca:a8:cc:e1:58:d7:d7:47:75:76:06:da:8a:1c:59:
75:e9:33:50:33:cb:8c:30:f3:c3:b4:85:e2:7d:64:
11:e0:61:b8:6c:52:37:97:d8:7f:f5:68:78:01:a2:
45:3b:6c:6d:01:5e:e4:da:db:a6:72:30:71:12:8d:
25:d0:3f:6f:ab:c7:bf:f2:90:0c:76:7e:d7:26:c6:
76:e7:f1:6c:b0:4b:50:46:c6:a5:ef:e3:80:5c:b7:
bc:6e:86:51:ee:a5:6f:bc:95:11:6b:63:74:07:54:
b5:6b:47:cc:05:83:9e:c6:64:ed:e6:2a:77:33:d9:
9f:1b:f3:6b:26:60:77:84:6c:c1:23:c7:bc:0c:53:
8e:dd
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
D6:05:53:D9:86:32:27:48:56:E3:2D:9A:68:C5:EA:E1:20:79:0F:C1
X509v3 Authority Key Identifier:
keyid:A9:A3:DC:1E:01:BE:FF:0B:27:FB:85:3E:02:9E:51:2E:A9:2B:17:04
Authority Information Access:
CA Issuers - URI:http://x1.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x1.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: sha256WithRSAEncryption
c4:d3:1e:e4:e7:ba:96:dc:0e:3d:d3:b2:43:c5:3f:da:7b:c3:
e1:48:8e:c2:bd:9b:bf:2a:37:d8:0b:fb:d8:f4:0e:97:82:17:
92:cc:b5:4c:15:2f:78:56:b3:70:63:21:60:c5:ad:1f:f8:13:
0b:7b:e3:8e:bc:eb:94:cb:69:0b:b9:40:63:03:49:39:2e:ba:
e2:dd:cb:a5:0d:e1:62:05:0c:b2:7a:40:10:cd:c4:5c:dc:e4:
2e:da:5f:37:41:d1:79:03:85:a2:dd:0a:ec:dd:0d:7a:64:fb:
5e:90:bc:4c:6b:95:af:4c:d0:94:e8:b4:ce:33:50:4f:6a:40:
0e:38:94:e3:ed:8e:e1:26:3b:eb:8f:2b:a2:5a:34:64:2f:14:
ed:0f:e7:94:0b:d1:8d:e6:ad:a8:88:4e:f4:27:14:71:b0:d3:
b3:27:19:9d:27:1c:4f:53:c7:c8:3e:90:5b:1b:82:2e:76:bd:
cc:92:c5:e0:22:ec:e0:de:7e:ec:de:f2:02:0d:a1:80:db:f6:
86:47:cd:87:b5:92:bc:63:09:72:e3:23:c7:79:c8:7e:e2:dd:
e1:e1:6a:c6:2e:c1:35:cb:7a:a6:b5:2e:2e:fe:54:99:25:b4:
9f:dc:92:65:a4:ca:bb:54:16:63:ad:d6:6d:11:db:cb:4a:87:
37:50:5a:3e:12:eb:5f:2d:cc:51:07:ef:df:97:da:a5:da:96:
8a:9a:60:bf:fa:b7:68:c0:27:50:f8:83:7e:5c:26:9c:77:4d:
ed:07:4b:be:85:85:40:95:2b:d9:f5:a6:58:c2:fd:28:2e:dc:
06:86:67:70:a2:ad:86:5b:48:c8:d7:55:ba:18:40:b9:57:4d:
f9:6c:00:5d:c2:ab:ec:8e:03:76:d6:9b:0f:ca:de:81:b7:66:
52:5e:9a:17:b6:7b:6a:d1:04:8d:1d:b3:fe:d6:50:a1:60:03:
38:f6:07:ed:70:3d:73:19:bf:ef:1f:c2:dc:b0:70:99:39:ac:
71:91:13:ef:a5:cf:b7:64:a6:5b:29:b9:3d:92:a5:1f:c3:25:
d6:2e:d5:e3:f5:14:70:33:57:38:14:67:5a:23:30:cf:0e:bc:
6c:7a:b3:9e:e9:49:6f:58:b2:10:51:91:32:ee:16:cb:1a:8f:
eb:be:ab:e2:ba:d2:c8:4a:f4:bd:f1:cc:a3:8d:a5:fd:a7:d0:
77:e2:c7:04:a9:47:93:56:42:fc:58:48:32:02:35:40:02:9b:
1d:ae:f7:24:d9:39:01:c5:66:78:60:74:a9:92:fa:07:10:e3:
94:e7:15:ff:63:0d:ad:6d:3c:a4:cf:10:a2:83:e5:f6:7f:56:
ac:83:5c:3d:1f:f0:82:14
```
int-r4.cert.pem.txt
```text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
25:5e:9c:00:20:eb:9d:1c:29:d2:fb:f1:89:04:77:c1
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = Internet Security Research Group, CN = (FAKE)
ISRG Root X1
Validity
Not Before: Sep 4 00:00:00 2020 GMT
Not After : Sep 15 16:00:00 2025 GMT
Subject: C = US, O = Let's Encrypt, CN = (FAKE) R4
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:d4:c3:84:ce:00:e7:76:34:d5:2a:bb:e4:95:4e:
bc:52:a2:b2:9a:29:9c:56:5b:b9:a4:f0:07:9a:4f:
29:55:7a:97:97:12:78:f8:00:8c:d1:2b:de:6a:0d:
be:d0:5b:b4:74:c3:73:d7:e7:7b:da:bc:1b:72:0d:
30:7c:3a:3b:4f:25:c2:4d:1d:fc:60:21:c7:dd:b9:
a0:e2:fb:65:9f:e9:aa:ed:01:d4:bd:5a:aa:ce:2b:
51:ae:97:39:5d:cc:b2:42:30:40:17:91:3c:8e:d8:
b0:16:b9:16:e0:e8:30:ad:f2:9e:6b:1a:49:a6:9a:
19:6f:bf:41:24:d7:98:bb:6c:85:52:4b:1e:a9:58:
e9:e1:9a:83:4b:a9:14:6a:c3:5d:4c:45:68:30:10:
bd:45:ff:6d:3d:08:fe:88:c5:d6:7d:d1:74:6b:f8:
57:c2:e8:3f:34:42:fa:c2:f4:58:e6:05:88:c7:ea:
e6:17:a2:fd:32:72:4b:a4:2e:6e:85:51:8b:f4:d7:
3e:d3:a7:f9:d9:f5:c6:bc:dd:63:1f:ef:26:b0:98:
b3:a4:b1:f9:b2:b2:9b:9f:34:c8:75:29:e0:88:78:
75:fe:c9:7e:a7:5c:c0:a0:5f:d6:fd:15:0f:3b:0f:
ca:03:3d:b8:50:19:93:a1:74:ac:52:5c:f9:cf:82:
75:89
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Subject Key Identifier:
77:52:2C:3B:1F:BE:4B:22:EB:22:14:21:16:47:40:AA:F9:4C:C5:C4
X509v3 Authority Key Identifier:
keyid:A9:A3:DC:1E:01:BE:FF:0B:27:FB:85:3E:02:9E:51:2E:A9:2B:17:04
Authority Information Access:
CA Issuers - URI:http://x1.i.lencr.org/
X509v3 CRL Distribution Points:
Full Name:
URI:http://x1.c.lencr.org/
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
Signature Algorithm: sha256WithRSAEncryption
11:e3:c8:53:c6:91:a4:cd:fc:00:6b:ec:12:36:4a:4d:58:43:
c4:60:e4:5e:95:83:f9:dd:2f:f0:34:b5:ed:77:7e:22:7c:db:
a6:e9:a9:fa:40:b2:db:55:14:3a:d6:2e:f8:9a:a4:c3:e9:aa:
bc:69:9d:4c:27:84:fa:e4:b5:61:72:f3:91:58:ce:45:78:9a:
17:32:16:55:f0:a5:1d:89:75:08:11:66:c8:78:fe:71:05:99:
3a:0b:db:11:d9:92:59:45:ff:4c:4b:6b:1c:24:4d:a4:43:f8:
4f:5b:f0:d9:80:c0:56:78:27:8b:94:bd:2c:c1:75:89:65:c0:
04:9f:ba:3f:1b:db:6a:a3:fd:e7:48:8f:49:dc:0d:9f:11:9b:
53:8e:e1:ea:87:81:72:20:16:d2:55:b1:da:13:ed:8c:b3:76:
1f:35:c4:3b:12:1a:29:7d:73:f4:55:1d:06:bd:53:de:6d:a9:
33:73:5c:96:cc:38:1f:66:4e:9b:d4:88:38:33:9c:bb:20:33:
0e:db:2d:a2:03:fa:8f:8a:7e:7c:29:a2:d3:9c:28:d5:31:81:
07:ab:f8:8c:3d:f9:ad:1c:c5:c8:85:86:d8:ad:67:dd:de:e4:
eb:73:18:c0:12:5d:7d:87:b9:ea:ab:25:74:48:39:ba:b5:b8:
04:ea:d1:92:23:96:c7:97:6c:0a:7e:32:f0:76:0d:1a:80:e5:
63:3a:86:86:60:65:8c:61:f1:cd:a1:61:f7:7e:80:92:dd:44:
92:e7:82:0f:1b:d9:61:ea:f9:92:f2:65:dd:40:1f:c8:a1:2a:
f5:55:95:f4:29:85:fa:ad:03:24:e9:09:39:80:b0:05:b8:9b:
a3:59:b8:52:b9:4a:ef:9f:59:e3:57:72:29:fe:3e:bd:46:55:
19:af:5d:61:96:7d:be:ce:1f:e0:aa:51:8f:c8:dc:27:10:a8:
aa:d6:61:41:fc:3e:e4:cb:86:54:0a:4b:60:f6:27:18:b5:70:
17:94:b7:00:07:6d:6b:95:db:e4:28:8a:fa:5e:9c:76:a3:a5:
45:7d:9d:ca:4b:c6:2f:84:91:7a:09:7a:8c:8a:db:b5:20:10:
cf:7f:7a:90:48:8d:6e:47:a4:03:d4:19:65:49:a5:96:49:e9:
e2:1d:af:a1:e2:5e:a0:4c:25:39:c3:8c:b6:01:1c:4b:3b:be:
41:6b:4d:28:b0:e3:fc:01:a7:e8:0e:f1:38:2e:3c:a3:25:e2:
c7:83:4c:4b:f8:95:98:91:08:ae:90:56:48:db:96:69:57:44:
5a:4d:b8:42:3e:5e:38:f3:3f:73:02:b9:44:7d:0f:71:fd:56:
70:1c:da:04:9f:8b:20:ce
```
Jacob Hoffman-Andrews
Sep 1, 2020, 5:02:56 PM9/1/20
to dev-secur...@lists.mozilla.org
Update on this: Thanks to the excellent zmap/zlint tool, we realized we
were missing the digitalSignature keyUsage on our planned new
intermediates. We've updated the demo repo and our forum post (
https://community.letsencrypt.org/t/detailed-2020-hierarchy/131019) to
indicate that we plan to include digitalSignature on these intermediates,
so we can sign OCSP directly from them.
were missing the digitalSignature keyUsage on our planned new
intermediates. We've updated the demo repo and our forum post (
https://community.letsencrypt.org/t/detailed-2020-hierarchy/131019) to
indicate that we plan to include digitalSignature on these intermediates,
so we can sign OCSP directly from them.
Reply all
Reply to author
Forward
0 new messages