Change Chia Root CA to expire 31 Dec 2037 #20281
Merged
+37
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
emlowe
added
the
Changed
Member
|
Just tested this as well on a fresh install/chia root and expiration date shows up properly, and I was able to get peers and starting syncing fine. Did you want to delete the old ca before we merge this, or later? |
cmmarslender
approved these changes
Nov 20, 2025
Contributor
|
@emlowe and @cmmarslender have spoken outside this PR to address the open question in this thread - merging. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Technically, this generates a new Root CA that uses the same key material and serial number, such that all old certificates and new certificates remain valid in both directions. That is, old certificates generated from the old CA will validate with the new CA, and new certificates generated from the new CA will validate with the old CA.
This extends the expiration out to 31 Dec 2037
The procedure is as follows:
Generate new signing request :
openssl x509 -x509toreq -in chia_ca.crt -signkey chia_ca.key -out newca.crsGenerate new CA with same serial:
openssl x509 -req -days 4425 -in newca.csr -signkey chia_ca.key -out chia_ca.crt -extfile ./renewedselfsignedca.conf -extensions v3_ca -set_serial 0x5C8A71239328650EB9FEF85CEC32BF779CA6A0C5also included the configuration file used to set the extensions for future use.
The
chia_ca_old.crtcan probably be deleted after verification that this works. I have tested it locally and my node can connect without issue to the network