Certificati ssl

Certificati digitali SSL

Audience

Questo argomento è d'interesse solo a chi deve connettersi in modo sicuro (SSL o TLS) con server LDAP, Web, Activemq ecc con del software custom (quindi ai programmatori) o a chi deve configurare l'accesso ai desktop che si autenticano con LDAP (client Windows con pGina, client Mac o Linux non in join con AD).

Autorità di certificazione

Unimore si appoggia al servizio di emissione certificati con un emettitore esterno negoziato da Géant ogni 5 anni. Periodicamente l'emettitore esterno può cambiare.

DigiCertCA

E' stato l'emettitore esterno di Unimore fino al 30/04/2020. L'ultimo certificato emesso scade il 9/07/2022.

Sotto l'autorità radice c'era la autorità intermedia:

   subject= /C=NL/ST=Noord-Holland/L=Amsterdam/O=TERENA/CN=TERENA SSL CA 3
   issuer= /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA
   SHA1 Fingerprint=77:B9:9B:B2:BD:75:22:E1:7E:C0:99:EA:71:77:51:6F:27:78:7C:AD

e poi direttamente il certificato.

Non c'è differenza se la chiave privata del certificato è RSA o ECC.

Sectigo

Sectigo è l'emettitore dal 01/05/2020.

La sua CA radice è:

   subject= /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
   issuer= /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
   notBefore=Jan  1 00:00:00 2004 GMT
   notAfter=Dec 31 23:59:59 2028 GMT  
   SHA256 Fingerprint=D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4

Le catene intermedie differiscono se la chiave è RSA o ECC.

Le due CA intermedie nel caso ECC (validazione OV):

   subject= /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust ECC Certification Authority
   issuer= /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
   notBefore=Mar 12 00:00:00 2019 GMT
   notAfter=Dec 31 23:59:59 2028 GMT
   SHA256 Fingerprint=A6:CF:64:DB:B4:C8:D5:FD:19:CE:48:89:60:68:DB:03:B5:33:A8:D1:33:6C:62:56:A8:7D:00:CB:B3:DE:F3:EA

   subject= /C=NL/O=GEANT Vereniging/CN=GEANT OV ECC CA 4
   issuer= /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust ECC Certification Authority
   notBefore=Feb 18 00:00:00 2020 GMT
   notAfter=May  1 23:59:59 2033 GMT
   SHA256 Fingerprint=08:37:99:E8:B2:B9:01:6E:44:70:2E:BF:9B:F3:69:CE:25:3F:E1:FB:EB:65:0E:5D:F1:0E:F4:4D:87:BF:3B:AE

Mentre nel caso RSA (validazione OV):

   subject= /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
   issuer= /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
   notBefore=Mar 12 00:00:00 2019 GMT
   notAfter=Dec 31 23:59:59 2028 GMT
   SHA256 Fingerprint=68:B9:C7:61:21:9A:5B:1F:01:31:78:44:74:66:5D:B6:1B:BD:B1:09:E0:0F:05:CA:9F:74:24:4E:E5:F5:F5:2B

   subject= /C=NL/O=GEANT Vereniging/CN=GEANT OV RSA CA 4
   issuer= /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
   notBefore=Feb 18 00:00:00 2020 GMT
   notAfter=May  1 23:59:59 2033 GMT
   SHA256 Fingerprint=37:83:4F:A5:EA:40:FB:F7:B6:11:96:95:59:62:E1:CA:05:58:87:24:35:E4:20:66:53:D3:F6:20:DD:8E:98:8E

Se invece il certificato è richiesto con il protocollo ACME (solo RSA) la catena è:

   subject= /C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo ECC Organization Validation Secure Server CA
   issuer= /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust ECC Certification Authority
   notBefore=Nov  2 00:00:00 2018 GMT
   notAfter=Dec 31 23:59:59 2030 GMT
   SHA256 Fingerprint=34:57:10:67:52:40:02:12:90:3A:35:45:CA:3B:2E:F3:84:A4:56:97:2B:D9:51:D8:D8:40:C1:B0:A3:79:EF:A1

più il certificato CN=USERTrust ECC Certification Authority già visto sopra.

Tuttavia dal 4 gennaio 2023 si è cominciato ad usare lo endpoint ACME che usa le stesse certification authority intermedie del caso manuale.

Poi ci sono le validazioni EV. qui cambia il certificato intermedio GEANT:

caso ECC:

   subject= /C=NL/O=GEANT Vereniging/CN=GEANT EV ECC CA 4
   issuer= /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust ECC Certification Authority
   notBefore=Feb 18 00:00:00 2020 GMT
   notAfter=May  1 23:59:59 2033 GMT
   SHA256 Fingerprint=86:0F:8E:49:84:FC:AA:AA:78:C8:7F:07:13:F2:03:18:1B:57:D7:B5:56:FE:D9:79:CE:14:DC:A0:1F:FA:4A:54

caso RSA:

   subject= /C=NL/O=GEANT Vereniging/CN=GEANT EV RSA CA 4
   issuer= /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
   notBefore=Feb 18 00:00:00 2020 GMT
   notAfter=May  1 23:59:59 2033 GMT
   SHA256 Fingerprint=DB:AC:2F:AE:4F:8C:94:9B:1A:30:CF:87:1E:AB:58:95:7F:64:20:B7:97:A5:12:55:06:B8:CE:DD:48:F5:D7:84

Client certificates

Dal 2023 i certificati client hanno la loro catena.

Caso ECC:

   subject=O = Research and Education Trust, CN = Research and Education Trust ECC Root CA
   issuer=O = Research and Education Trust, CN = Research and Education Trust ECC Root CA
   notBefore=Aug  8 12:11:58 2023 GMT
   notAfter=Jan 17 23:59:59 2038 GMT
   sha256 Fingerprint=02:92:55:E6:72:5E:56:96:C7:61:84:14:5C:8D:B5:30:6F:14:F8:51:A9:A4:6B:D5:10:D4:E9:BA:A6:AF:57:46

   subject=C = NL, O = GEANT Vereniging, CN = GEANT TCS Authentication ECC CA 4B
   issuer=O = Research and Education Trust, CN = Research and Education Trust ECC Root CA
   notBefore=Aug  8 12:12:07 2023 GMT
   notAfter=Jan 17 23:59:59 2038 GMT
   sha256 Fingerprint=A9:12:9F:03:86:55:EA:9C:EF:F9:35:3E:7E:87:C7:63:2F:6F:D6:29:04:52:62:48:56:21:8A:3B:90:55:18:6E

Probabilmente la catena è diversa per i client certificate per la posta e per le procedure automatizzate.