Hello, welcome to the Monday, June 1st, 2020 edition of the Sansanet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

This weekend, the Sectical at Trust External Certific Authority route was expiring.

Now, sectico, not really a household name,

but you may have heard of Komodo, which is essentially sectical, and the route CA that was expiring here was particularly used to cross-sign certificates. Whenever a new certificate authority starts up, there is of course that problem, the beginning, that nobody trusts that certificate authority yet.

Initially, for example, let's encrypt had this problem.

And the result or the solution here is that you can ask an already established, trusted

certificate authority to cross-sign your certificates. So now essentially there are two root

certificates that are used to sign your certificates. And then hopefully browsers will have

one of those root certificates in their trust store and use it.

Now, this particular Sactico certificate authority was expiring on Saturday,

and in particular in the EDU space, it was heavily used,

but also some other Komodo in particular in the EDU space, it was heavily used, but also some other Komodo in particular

derived certificates were cross-signed using this certificate authority, and in some cases

you may have been experiencing TLS errors as a result. The problem doesn't seem to be widespread

because there should also be that

second set of authority, but embedded devices, older operating systems or such that haven't been

updated with a new set of root certificates, they may still rely on this sectico at trust external CA for actually to verify

certificates. So if you experienced issues like this over the weekend, like Saturday is when

this certificate expired, well, you have to update your certificates that's sort of one fix. Also, make sure that

on the declined, the certificate trust store, basically keep all the trusted, certificate authorities

is up to date. That's something that's typically being updated with operating system updates,

...