Let's Encrypt Root CA Cert

Sat, 13 Oct 2018 00:00:00 +0000

Overview / Explination

Since Let’s Encrypt’s own root certificate authority, ISRG Root X1, is still quite new and not commonly trusted. To get around this issue, Let’s Encrypt’s intermediate has be graciously cross-signed by IdentTrust’s root certificate authority DST Root CA X3, which is commonly trusted by clients.

What this means is that most certificates issued by Let’s Encrypt have an origin of trust from IdentTrust’s root CA.

Take for example the OpenChirp MQTT server. We can use openssl s_client to inspect the certificate presented to the user.

openssl s_client -connect mqtt.openchirp.io:8883

depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = mqtt.openchirp.io
verify return:1
---
Certificate chain
 0 s:/CN=mqtt.openchirp.io
 i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
...

The beginning of the output shows the root is CN = DST Root CA X3, which doesn’t look like Let’s Encrypt’s own ISRG Root X1.

So, if you need to present the root CA cert to some program (for verification), you need to present IdentTrust’s root CA cert. See the next section to learn how to grab a usable x509 PEM formatted cert.

Grab Cert and Convert

If we want to present the trusted root CA cert for a Let’s Encrypt issued certificate, we need to present the IdentTrust root CA cert. More specifically, we need to reference the TrustID X3 root cert. The only problem with this is that IdentTrust only offers their certificate in PKCS7 binary format (.p7b), which is unusable in a lot of reasonable applications. We need x509 PEM format.

The following instructions will show how to compose the x509 .pem file for the DST Root CA X3 cert.

TLDR

At the time of writing this, the following wget line was capable of grabbing the TrustID X3 cert in p7b format. The next openssl would convert that .p7b file to an x509 .pem file for normal use.

wget https://www.identrust.com/node/935 -O trustidrootx3_chain.p7b
openssl pkcs7 -inform DER -in trustidrootx3_chain.p7b -print_certs -outform PEM -out trustidrootx3_chain.pem

You can then use the trustidrootx3_chain.pem as the CAfile parameter of client programs.

Fallback Instructions

If the above commands failed, you can download the PKCS7 binary file (.p7b) file from the IdentTrust download page bellow.

To convert that PKCS7 binary file to x509 PEM, use the following openssl command:

openssl pkcs7 -inform DER -in <THE_DOWNLOADED_P7B_CERT> -print_certs -outform PEM -out trustidrootx3_chain.pem

You can then use the trustidrootx3_chain.pem as the CAfile parameter of client programs.

Example Usage of x509 PEM

Mosquitto Client

mosquitto_sub -v -i monitor$RANDOM -h mqtt.openchirp.io -p 8883 --cafile ./trustidrootx3_chain.pem -u <USER> -p <TOKEN>

Regenerate Chrome App/Extension Desktop Shortcuts

Wed, 20 Dec 2017 11:30:41 -0500

Table of Contents

Description

This is a quick how-to for regenerating the .desktop shortcuts associated with Google Chrome Apps or Extensions.

Rant

Being able to launch your favorite Chrome App/Extension straight from your desktop manager’s launcher is a big win in my book. My typical go-to is Google Keep. With my Gnome Shell setup, all I have to do is hit the Super key on my keyboard to bring up the searchable Gnome launcher, ever so slightly start typing k e e p, and pound the enter key. Presto, I’m in my notes taking app.

Every once in a while, a desktop shortcut disappears (possibly self inflicted) or becomes corrupt. The monotony of traversing through Chrome, to the Apps menu, and clicking on the correct App/Extension tile haunts me to this day.

This article is needed due to the dearth of information related to Chrome Extension desktop shortcuts for Linux desktop environments. I also needed a good tutorial to kickoff my Posts section.

Here is how to fix it

Method 1

Go to the All Apps page.

This is also the URL chrome://apps.
Right click on the App or Extension you wish to regenerate a shortcut for.
Click Create shortcuts...
Deselect Desktop, select Application menu, and click Create. A Desktop shortcut is pointless when you have Desktop icons disabled in Gnome Shell. [default for Gnome Shell]

Method 2

Press the three vertical dots in the top right of the browser.
Navigate to More tools and then Extensions
Click the Details linked text on the App or Extension you wish to regenerate a shortcut for.
Click Create shortcuts...
Deselect Desktop, select Application menu, and click Create. A Desktop shortcut is pointless when you have Desktop icons disabled in Gnome Shell. [default for Gnome Shell]

tutorial | Craig Hesling