More help with SELF_SIGNED_CERT_IN_CHAIN and npm

http://blog.npmjs.org/post/78165272245/more-help-with-self-signed-cert-in-chain-and-npm

by seldo • 12 years ago

29 9 12 years ago

blog.npmjs.org

STRML4• 12 years ago

I'm worried about this - they state:

  We are rolling back to the older cert now, but since the registry is distributed 
  by a global CDN this process is slower than we’d like, and we don’t want 
  to break things (further) by rushing the process.

If they roll back to the older cert, every install of npm that was "fixed" via the steps in the last post, or updated to latest (node v10.0.26/npm v1.4.4) will break. Perhaps I am missing something but it sounds as though they intend to follow up breaking most npm installs by breaking most npm installs yet again.

seldo4• 12 years ago

That's not correct. The latest npm (and any npm configured with ca="") will use the CA baked into your operating system's version of OpenSSL. Our old cert, from GlobalSign, works just fine with OpenSSL.

STRML4• 12 years ago

So you're reverting to a cert that is not the old self-signed cert?

rwg• 12 years ago

After reading both blog posts, I still didn't know exactly what the heck actually happened, so I downloaded node.js 0.11.9 (released in November 2013 but not the latest version) and ran "npm config get ca" to see what npm's default trusted certificate store used to be. There were four certificates:

• an "npm Certificate Authority" X.509v1 certificate valid from 2011-09-05 (an X.509v1 cert in 2011? srsly?)

• two of GlobalSign's Root CA certificates

• a GlobalSign subordinate CA certificate

What I'm guessing happened is that the certificate https://registry.npmjs.org used a long time ago was signed by that "npm Certificate Authority" certificate. Then they switched to a signed-by-GlobalSign certificate. Then, two days ago, they switched to an EV certificate from DigiCert, and that's when all hell broke loose for people not using the latest version of npm because not-latest versions of npm would only trust certificates that chained up to GlobalSign's Root CAs or the "npm Certificate Authority."

If I'm right about what happened, then the brunt of this kerfuffle might've been avoided by making ca="" the default in npm releases as soon as the GlobalSign-signed certificate hit production and everyone was happy that it was working. Hindsight is 20/20 like that, though.

seldo4• 12 years ago

That is pretty much exactly correct.

More help with SELF_SIGNED_CERT_IN_CHAIN and npm

Related Stories