Did the raw.githubusercontent.com Global Root certificate change?

[NoTreesSupport]

Select Topic Area

Question

Body

Up until about 3/14 I was using the certificate with this:

// certificate for https://raw.githubusercontent.com
// DigiCert Global Root CA, valid until Sun Apr 13 2031, size: 1704 bytes
-----BEGIN CERTIFICATE-----
MIIEvjCCA6agAwIBAgIQBtjZBNVYQ0b2ii+nVCJ+xDANBgkqhkiG9w0BAQsFADBh
...
A7sKPPcw7+uvTPyLNhBzPvOk
-----END CERTIFICATE-----

And my code started getting invalid certificate errors. I checked the current cert and it's now different:

// certificate for https://raw.githubusercontent.com
// DigiCert Global Root G2, valid until Sat Mar 29 2031, size: 1720 bytes
-----BEGIN CERTIFICATE-----
MIIEyDCCA7CgAwIBAgIQDPW9BitWAvR6uFAsI8zwZjANBgkqhkiG9w0BAQsFADBh
...
JCqVJUzKoZHm1Lesh3Sz8W2jmdv51b2EQJ8HmA==
-----END CERTIFICATE-----

This is an issue since my firmware can't pull an update because it has the previous certificate.

Why would it change when it said it was valid until 2031?

[owen63]

I experienced a similar problem. My last successful access was Friday March 15. It failed when I retried today, Monday March 18.
I was using:
Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA Validity Not Before: Nov 10 00:00:00 2006 GMT Not After : Nov 10 00:00:00 2031 GMT Subject: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
I am now using (from openssl s_client -showcerts -connect objects.githubusercontent.com:443):
Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2 Validity Not Before: Mar 30 00:00:00 2021 GMT Not After : Mar 29 23:59:59 2031 GMT Subject: C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
I would like to know why the previous certificate failed now and whether it's likely to happen again (before 2031).

[aashah]

The previous certificate was set to expire, our automation picked up on this and auto-rotated it. The intermediate cert, that signed the host cert, did not change and is valid for many more years.

[NoTreesSupport]

@owen63 That would work if there was a way to push the cert down to the IoT devices. They have the old public key they are using to get the OTA firmware and it's rejected. So they have no way to get the new cert/firmware. It looks to the device like Github is an invalid endpoint.

[owen63]

@NoTreesSupport The cert appears to have changed, but surely many others would be similarly affected if it had?

[aashah]

I'll send this discussion to someone on the network team that manages these certs. They can correct me if I've misspoken 🙇‍♂️

[aashah]

I spoke with some folks, and will try to summarize what they shared with me. Just to be clear, I don't work on that team, and am just trying to help out in these community discussions.

I was wrong, and you're totally right that a cert up the chain changed as well. This was entirely outside of our control, and was done by DigiCert. They communicated this as part of https://knowledge.digicert.com/general-information/digicert-root-and-intermediate-ca-certificate-updates-2023

With our cert nearing expiration, our automation renewed the certificate, and DigiCert used their newer DigiCert Global Root G2. The old chain was something like:

DigiCert TLS RSA SHA256 2020 CA1 --> DigiCert Global Root CA

And the new chain like:

DigiCert Global G2 TLS RSA SHA256 2020 CA1 --> DigiCert Global Root G2

With the expiration we configured during certificate renewal, DigiCert had to use the newer CA. This was outside our control here.

From here, in my own opinion, I'd advise you to submit a ticket with Support if you would like to get further assistance/answers.

[owen63]

@aashah Thanks for the explanation. I presume most clients had no issue because they already had the newer DigiCert Global Root G2 in the trust store?