diff --git a/public/_redirects b/public/_redirects index a26f8a0fc7a6259..44b08f00f31c554 100644 --- a/public/_redirects +++ b/public/_redirects @@ -1008,6 +1008,7 @@ /ssl/reference/certificate-validation-options/ /ssl/concepts/#validation-level 301 /ssl/reference/cipher-suites/custom-certificates/ /ssl/edge-certificates/custom-certificates/#certificate-packs 301 /ssl/reference/cipher-suites/matching-on-origin/ /ssl/origin-configuration/cipher-suites/#match-on-origin 301 +/ssl/reference/migration-guides/lets-encrypt-chain/ /ssl/reference/certificate-authorities/#lets-encrypt 301 /ssl/reference/validation-backoff-schedule/ /ssl/edge-certificates/changing-dcv-method/validation-backoff-schedule/ 301 /ssl/universal-ssl/changing-dcv-method/ /ssl/edge-certificates/changing-dcv-method/ 301 /support/dns/how-to/certification-authority-authorization-caa-faq/ /ssl/edge-certificates/troubleshooting/caa-records/ 301 diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/reference/troubleshooting.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/reference/troubleshooting.mdx index 762bab817c9de5c..b0bc1b18702e6b8 100644 --- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/reference/troubleshooting.mdx +++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/reference/troubleshooting.mdx @@ -79,7 +79,7 @@ More details can be found on the [CAA records FAQ](/ssl/edge-certificates/troubl As Let's Encrypt - one of the [certificate authorities (CAs)](/ssl/reference/certificate-authorities/) used by Cloudflare - has announced changes in its [chain of trust](/ssl/concepts/#chain-of-trust), starting September 9, 2024, there may be issues with older devices trying to connect to your custom hostname certificate. -Refer to the [full migration guide](/ssl/reference/migration-guides/lets-encrypt-chain/) for details and consider the following solutions: +Consider the following solutions: - Use the [Edit Custom Hostname](/api/operations/custom-hostname-for-a-zone-edit-custom-hostname) endpoint to set the `certificate_authority` parameter to an empty string (`""`): this sets the custom hostname certificate to "default CA", leaving the choice up to Cloudflare. Cloudflare will always attempt to issue the certificate from a more compatible CA, such as [Google Trust Services](/ssl/reference/certificate-authorities/#google-trust-services), and will only fall back to using Let’s Encrypt if there is a [CAA record](/ssl/edge-certificates/caa-records/) in place that blocks Google from issuing a certificate. diff --git a/src/content/docs/ssl/edge-certificates/custom-certificates/troubleshooting.mdx b/src/content/docs/ssl/edge-certificates/custom-certificates/troubleshooting.mdx index 2735c22a395b33d..3fbea04a3179143 100644 --- a/src/content/docs/ssl/edge-certificates/custom-certificates/troubleshooting.mdx +++ b/src/content/docs/ssl/edge-certificates/custom-certificates/troubleshooting.mdx @@ -36,7 +36,7 @@ As Let's Encrypt - one of the [certificate authorities (CAs)](/ssl/reference/cer If you are using a Let's Encrypt certificate uploaded by yourself as a custom certificate, consider the following: - If you use **compatible** or **modern** [bundle method](/ssl/edge-certificates/custom-certificates/bundling-methodologies/) and have uploaded your certificate before September 9, 2024, [update your custom certificate](/ssl/edge-certificates/custom-certificates/uploading/#update-an-existing-custom-certificate) so that it can be bundled with the new chain. -- If you use **user-defined** bundle method, make sure that your certificates uploaded after September 30, 2024, do not use the Let's Encrypt cross-signed chain. For details, refer to the [full migration guide](/ssl/reference/migration-guides/lets-encrypt-chain/). +- If you use **user-defined** bundle method, make sure that your certificates uploaded after September 30, 2024, do not use the Let's Encrypt cross-signed chain. ## Error codes diff --git a/src/content/docs/ssl/reference/certificate-authorities.mdx b/src/content/docs/ssl/reference/certificate-authorities.mdx index 6b86e6ce1019685..9aa42865ed4bc41 100644 --- a/src/content/docs/ssl/reference/certificate-authorities.mdx +++ b/src/content/docs/ssl/reference/certificate-authorities.mdx @@ -57,9 +57,9 @@ This section summarizes commonly requested client support information. For the c ::: -The main determining factor for whether a platform can validate Let’s Encrypt certificates is whether that platform trusts the self-signed “ISRG Root X1” certificate. As Let's Encrypt announced a change in its chain of trust for 2024, devices that only trust the cross-signed version of the “ISRG Root X1” certificate will be impacted. Refer to [Let's Encrypt chain update](/ssl/reference/migration-guides/lets-encrypt-chain/) for details. +The main determining factor for whether a platform can validate Let's Encrypt certificates is whether that platform trusts the self-signed ISRG Root X1 certificate. As Let's Encrypt announced a [change in its chain of trust in 2024](https://blog.cloudflare.com/shortening-lets-encrypt-change-of-trust-no-impact-to-cloudflare-customers/), older devices (for example Android 7.0 and earlier) that only trust the cross-signed version of the ISRG Root X1 are no longer compatible. -You can find the full list of supported clients in the [Let's Encrypt documentation](https://letsencrypt.org/docs/certificate-compatibility/). Older versions of Android and Java clients might not be compatible with Let’s Encrypt certificates. +You can find the full list of supported clients in the [Let's Encrypt documentation](https://letsencrypt.org/docs/certificate-compatibility/). Older versions of Android and Java clients might not be compatible with Let's Encrypt certificates. #### Other resources @@ -168,5 +168,4 @@ The following table lists the CAA record content for each CA: | Google Trust Services | `pki.goog; cansignhttpexchanges=yes` | | SSL.com | `ssl.com` | | Sectigo | `sectigo.com` | -| DigiCert | `digicert.com; cansignhttpexchanges=yes` | - +| DigiCert | `digicert.com; cansignhttpexchanges=yes` | \ No newline at end of file diff --git a/src/content/docs/ssl/reference/migration-guides/lets-encrypt-chain.mdx b/src/content/docs/ssl/reference/migration-guides/lets-encrypt-chain.mdx deleted file mode 100644 index 9a91dac624d3796..000000000000000 --- a/src/content/docs/ssl/reference/migration-guides/lets-encrypt-chain.mdx +++ /dev/null @@ -1,128 +0,0 @@ ---- -pcx_content_type: reference -title: Let's Encrypt chain update -sidebar: - order: 2 -head: [] -description: Review notes on the expiration of ISRG Root X1 cross-signed with - DST Root CA X3, and how it may affect Cloudflare customers that use Let's - Encrypt. ---- - -import { Details } from "~/components"; - -Let's Encrypt - one of the [certificate authorities (CAs)](/ssl/reference/certificate-authorities/) used by Cloudflare - has announced changes in its [chain of trust](/ssl/concepts/#chain-of-trust).[^1] - -To minimize impact, besides communicating the changes and providing recommendations early, Cloudflare will proceed as follows: - -* Automatically switch to a different certificate authority the Cloudflare-managed certificates where you have not specifically chosen Let's Encrypt. -* Notify you of Cloudflare-managed certificates that you specifically set to use Let's Encrypt, and whether hostnames covered by these certificates are receiving requests from the [impacted devices or systems](#client-impact). -* Start bundling Let’s Encrypt certificates uploaded to Cloudflare with the appropriate chains, as long as the [bundling method](/ssl/edge-certificates/custom-certificates/bundling-methodologies/) is set to compatible or modern. - -The first changes you might see - namely if you are still getting requests from legacy devices - will appear on **September 9, 2024**. - -Refer to the sections below for more information on each of these actions and how they may reflect on the different certificate types. - -[^1]: As the IdenTrust cross-sign (DST Root CA X3) expires on **September 30, 2024**, the self-signed ISRG Root X1 will be the only chain used for RSA certificates issued through Let's Encrypt. Refer to [Background](#background) or our [blog](https://blog.cloudflare.com/shortening-lets-encrypt-change-of-trust-no-impact-to-cloudflare-customers) for details. - -## Client impact - -The expiration of the cross-signed chain will primarily affect older devices, for example Android 7.0 and earlier. Systems that solely rely on the cross-signed chain, lacking the ISRG Root X1 chain in their [trust store](/ssl/concepts/#trust-store), will also be affected. - -## Important dates - -* **June 2024**: Cloudflare will start automatically changing the CA for managed certificates where you had not opted to use Let's Encrypt. -* **September 9, 2024**: Cloudflare will stop using the cross-signed chain, both in certificate issuance and in [certificate bundling](#custom-certificates). -* **September 30, 2024**: The cross-signed chain will expire. - -## How your products are affected - -### Universal SSL - -[Universal](/ssl/edge-certificates/universal-ssl/) certificates will be automatically switched to a more compatible certificate authority (CA). You do not have to take any action to prepare for this change. - -### Advanced certificates - -If you have specifically chosen Let's Encrypt to issue your [advanced certificates](/ssl/edge-certificates/advanced-certificate-manager/), Cloudflare will check if your domain has been impacted and will reach out to you by email. - -The email will inform you which certificates are using Let's Encrypt as their CA and whether or not their hostnames are receiving requests from [clients impacted by the change](#client-impact). - -You can also find the list of certificates that use Let's Encrypt as the CA through the [List Certificates API endpoint](/api/operations/certificate-packs-list-certificate-packs). - -You can then [manage your advanced certificates](/ssl/edge-certificates/advanced-certificate-manager/manage-certificates/) to use a different CA if you choose to do so. - -### Total TLS - -For [Total TLS](/ssl/edge-certificates/additional-options/total-tls/), if you are concerned that using Let's Encrypt might impact your visitors' experience, go to **SSL/TLS** > **Edge Certificates** and make sure that a different certificate authority is selected in the Total TLS settings. - -Cloudflare will not change Total TLS certificates automatically. - -### Custom certificates - -#### Compatible or modern - -For [custom certificates](/ssl/edge-certificates/custom-certificates/) that use compatible or modern [bundle method](/ssl/edge-certificates/custom-certificates/bundling-methodologies/), and are uploaded before September 9, Cloudflare will continue to use the cross-signed chain until their expiry. - -After September 9, 2024, all Let’s Encrypt certificates uploaded to Cloudflare will be bundled with the ISRG Root X1 chain, instead of the cross-signed chain. - -:::caution - -As Cloudflare does not manage the [renewal of custom certificates](/ssl/edge-certificates/custom-certificates/renewing/), you will need to [update the custom certificate](/ssl/edge-certificates/custom-certificates/uploading/#update-an-existing-custom-certificate) before it expires. The new certificate that will be uploaded to extend the expiry will then be bundled with the new ISRG Root X1 chain. -::: - -#### User-defined - -For user-defined bundle method, Cloudflare always serves the chain that you upload. - -If you upload Let’s Encrypt certificates using this method, it is recommended that certificates uploaded after September 30, 2024, do not use the cross-signed chain. - -### Custom hostname - -For [custom hostname certificates](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/) that are specifically set to use Let's Encrypt, no change will happen automatically. - -Instead, Cloudflare will check the impact and reach out to you, as the SaaS provider, by email. - -To prevent this change from impacting clients, we recommend switching the CA that you use before September 9, 2024. Refer to the options below to understand how to achieve this: - - * Use the [Edit Custom Hostname](/api/operations/custom-hostname-for-a-zone-edit-custom-hostname) endpoint to set the `certificate_authority` parameter to an empty string (`""`): this sets the custom hostname certificate to "default CA", leaving the choice up to Cloudflare. Cloudflare will always attempt to issue the certificate from a more compatible CA, such as [Google Trust Services](/ssl/reference/certificate-authorities/#google-trust-services), and will only fall back to using Let’s Encrypt if there is a [CAA record](/ssl/edge-certificates/caa-records/) in place that blocks Google from issuing a certificate. -
- - ```sh - curl --request PATCH \\ - https://api.cloudflare.com/client/v4/zones/{zone_id}/custom_hostnames/{custom_hostname_id} \\ - --header "X-Auth-Email: " \\ - --header "X-Auth-Key: " \\ - --header "Content-Type: application/json" \\ - --data '{ - "ssl": { - "method": "txt", - "type": "dv", - "certificate_authority": "" - } - }' - - ``` - -
- - * Use the [Edit Custom Hostname](/api/operations/custom-hostname-for-a-zone-edit-custom-hostname) endpoint to set the `certificate_authority` parameter to `google`: this sets Google Trust Services as the CA for your custom hostnames. - -## Further recommendations - -* **Monitor inquiries from your visitors**: Once Let's Encrypt change is rolled out, it is recommended that you monitor your support channels for any inquiries related to certificate warnings or access problems. - -* **Update trust store**: If you control the clients that are connecting to your website or application, it is recommended that you update their [trust store](/ssl/concepts/#trust-store) to include the self-signed ISRG Root X1 chain to prevent impact. - -## Background - -Let’s Encrypt has been issuing RSA certificates through two chains: the self-signed ISRG Root X1 chain, and the ISRG Root X1 chain cross-signed by IdenTrust’s DST Root CA X3. - -As explained in the [Let's Encrypt announcement](https://letsencrypt.org/2023/07/10/cross-sign-expiration), the cross-signed chain has allowed their certificates to be widely trusted, while the self-signed chain gradually developed compatibility with various devices. - -As of late 2023, the number of Android devices trusting the self-signed ISRG Root X1 reached 93.9%, and Let's Encrypt has decided to drop the cross-signed chain. - -## Other resources - -* [Cloudflare CAs and certificates FAQ](/ssl/edge-certificates/troubleshooting/ca-faq/) -* [Let's Encrypt Chain of Trust](https://letsencrypt.org/certificates/) - diff --git a/src/content/docs/ssl/troubleshooting/general-ssl-errors.mdx b/src/content/docs/ssl/troubleshooting/general-ssl-errors.mdx index 06ff466b5aadaed..c36b6018371d164 100644 --- a/src/content/docs/ssl/troubleshooting/general-ssl-errors.mdx +++ b/src/content/docs/ssl/troubleshooting/general-ssl-errors.mdx @@ -18,7 +18,7 @@ Starting September 9, 2024, visitors that try to connect to your website using o ### Resolution -The fastest way to resolve this issue is to change your certificate to use [Google Trust Services](/ssl/reference/certificate-authorities/#google-trust-services) as the certificate authority. Refer to the [migration guide](/ssl/reference/migration-guides/lets-encrypt-chain/#how-your-products-are-affected) to learn how to proceed with each certificate type. +The fastest way to resolve this issue is to change your certificate to use [Google Trust Services](/ssl/reference/certificate-authorities/#google-trust-services) as the certificate authority. ## Outdated browsers