#1061: Certificate failure --------------------------------------+------------------------------------- Reporter: eschnett | Owner: Type: enhancement | Status: reopened Priority: minor | Milestone: Component: EinsteinToolkit website | Version: Resolution: | Keywords: --------------------------------------+-------------------------------------
Comment (by knarf):
I don't think this is a financial aspect. Root certificates, like any certificate, have a life span. Older systems eventually do not only have a problem because they cannot trust new root certificates, the ones they do trust eventually all expire. For this mechanism to work the list of trusted certificates needs to be updated from time to time. There is no way for us to change this.
You say that this is a problem on a "very popular OS". Do you have more information about that OS? A lot of the tools mentioned (wget, curl) use libraries like openssl under their hood. Which version of openssl is installed there?
My current Debian system (released Feb. 2011) ships with OpenSSL 0.9.8o 01 Jun 2010. This seems to be sufficient for 'our' root certificate. QueenBee on the other hand runs RHEL 4.5, released 2007-05-01 and uses OpenSSL 0.9.7d 17 Mar 2004. Unless the list of certificates was updated in the meantime the list of trusted certificates there is over 8 years old. I don't think you will find so many root certificates that had been valid at that time, will still be in some years and are still used to sign other certificates.
The problem can really only be solved by updating the list of trusted certificates - either (ideally) by the vendor, by the system administrator, or otherwise by the user.