Skip to content

Conversation

@emlowe
Copy link
Contributor

@emlowe emlowe commented Nov 19, 2025

Technically, this generates a new Root CA that uses the same key material and serial number, such that all old certificates and new certificates remain valid in both directions. That is, old certificates generated from the old CA will validate with the new CA, and new certificates generated from the new CA will validate with the old CA.

This extends the expiration out to 31 Dec 2037

The procedure is as follows:
Generate new signing request : openssl x509 -x509toreq -in chia_ca.crt -signkey chia_ca.key -out newca.crs
Generate new CA with same serial: openssl x509 -req -days 4425 -in newca.csr -signkey chia_ca.key -out chia_ca.crt -extfile ./renewedselfsignedca.conf -extensions v3_ca -set_serial 0x5C8A71239328650EB9FEF85CEC32BF779CA6A0C5

also included the configuration file used to set the extensions for future use.

The chia_ca_old.crt can probably be deleted after verification that this works. I have tested it locally and my node can connect without issue to the network

@emlowe emlowe requested a review from a team as a code owner November 19, 2025 21:18
@emlowe emlowe added the Changed Required label for PR that categorizes merge commit message as "Changed" for changelog label Nov 19, 2025
@cmmarslender
Copy link
Member

Just tested this as well on a fresh install/chia root and expiration date shows up properly, and I was able to get peers and starting syncing fine. Did you want to delete the old ca before we merge this, or later?

Copy link
Contributor

@wjblanke wjblanke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aok

@TheLastCicada
Copy link
Contributor

@emlowe and @cmmarslender have spoken outside this PR to address the open question in this thread - merging.

@TheLastCicada TheLastCicada merged commit fe51de9 into main Nov 21, 2025
614 of 616 checks passed
@TheLastCicada TheLastCicada deleted the EL.cni-root-expiration branch November 21, 2025 17:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Changed Required label for PR that categorizes merge commit message as "Changed" for changelog

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants