Repository navigation
fix(ssl): mark the self-signed root as a CA and repair existing roots - #513
Merged
Merged
Conversation
The root CA config had no extensions. OpenSSL < 3.2 then issues a v1 root, which is accepted as a trust anchor, but OpenSSL >= 3.2 (Ubuntu 26.04, Debian 13) issues a v3 root without basicConstraints CA:TRUE, so `openssl verify`, curl and browsers reject every self-signed site certificate (error 79, invalid CA certificate). - Issue the root with a critical basicConstraints CA:TRUE, keyUsage keyCertSign/cRLSign and a key identifier; site certificates get extendedKeyUsage serverAuth and a key identifier. - Existing v3 roots without CA:TRUE are re-issued with the same key and subject, by a container migration and again on the next `--ssl=self` site. Site certificates name their root by key id, so they stay valid and are not re-signed; the new root only replaces the old one after every site certificate signed by its key verifies against it. The system trust store copy is refreshed. - v1 roots are left alone: they work, their site certificates name the root by issuer and serial number, and replacing them would invalidate the copies users imported into browsers.
…assword out of ee.log The root CA repair re-trusts the root only where a trusted copy already exists (an admin may have removed it on purpose), and completes a refresh that failed after the root was replaced on the next run. The macOS keychain hint is only printed after an actual repair, the repair's temporary files get per-process names, and the openssl commands that take the root key password no longer write it to ee.log.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Repair failures can install unusable certificates, and migration rollback state is not persisted.
2 open findings
What changed in this PR
Fixes self-signed certificate compatibility with newer OpenSSL versions and repairs affected root CAs.
Changes:
- Adds required CA and server certificate extensions.
- Repairs existing invalid roots and refreshes system trust.
- Redacts certificate passwords from command logs.
| File | Description |
|---|---|
v3.ext.mustache |
Adds leaf certificate identifiers and server authentication usage. |
openssl.conf.mustache |
Defines valid root CA extensions. |
Site_Self_Signed.php |
Implements root repair, verification, trust refresh, and password redaction. |
20261001120000_site-command_repair_self_signed_root_ca.php |
Adds the upgrade migration for existing roots. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The self-signed root CA was generated from a config without extensions. OpenSSL < 3.2 then issues a v1 root (accepted as a trust anchor), but OpenSSL >= 3.2 (Ubuntu 26.04, Debian 13) issues a v3 root without
basicConstraints CA:TRUE, soopenssl verify, curl and browsers reject every self-signed site certificate with error 79 (invalid CA certificate).basicConstraints CA:TRUE,keyUsage keyCertSign, cRLSignand a key identifier; site certificates also getextendedKeyUsage serverAuth.--ssl=selfsite. Site certificates name their root by key id, so they keep working and are not re-signed; the new root only replaces the old one after every site certificate signed by its key verifies against it. An existing copy in the system trust store is refreshed.Users who imported the old root into a browser can keep it (same key); importing the new rootCA.pem replaces it.
Testing: unit tests with the real openssl CLI on OpenSSL 1.1.1, 3.0 and 3.5 (new root, repair, v1 root left alone, a leaf that would stop verifying, migration up/down); the Behat SSL scenario now also verifies strictly.