I just bought a certificate from RapidSSL. Looking up the chain, I found GeoTrust who is signed by Equifax.
Then I realized that the ”Equifax Secure Certificate Authority” is due to expire on 2018-08-22 at 16:42 GMT. While my certificate is due to expire on 2018-09-01 at 01:32 GMT. GeoTrust is due to expire on 2022-05-21 at 6:00. Giving my new cert a longer lifetime than a certificate further up the chain.
What will happen in the last eight days of my certificate? Will it no longer be valid as the chain will be broken?
I came across this while assembling the chain to get OSCP working in OpenSSL. OpenSSL spewed out errors when my chain did not contain Equifax whilst browsers and other clients seemed happy with just the GeoTrust certiface without going any further up the chain. (I presume browsers assume GeoTrust to be a top-level CA while OpenSSL is not happy with them.)
openssl ocsp -issuer RapidSSL_GeoTrust_Equifax.pem \ -cert my_rappidssl_cert.pem -url http://rapidssl-ocsp.geotrust.com
(This also affects nginx when set to OCSP staple certificate. It fails the same way OpenSSL does with an incomplete chain.)
Is there anyway I can get the last eight days of my certificate? Or should I ask for a 8-day refund? 😉
What will happen with the GeoTrust certificate after 2018?