How to remediate – SSL Certificate Chain Contains Certificates Expiring Soon

1. Introduction

2. Technical Explanation

The issue occurs when SSL certificates in the chain are nearing their expiry date. Browsers and other clients check certificate validity during TLS handshakes. An expiring or expired certificate breaks this trust, preventing a secure connection. Attackers can’t directly exploit this vulnerability to gain access but can disrupt service by simply waiting for the certificate to expire.

• Root cause: Certificates in the SSL chain have short remaining validity periods.
• Scope: Web servers (Apache, Nginx, IIS), load balancers (F5 BIG-IP, HAProxy), and any application using TLS/SSL are affected.

3. Detection and Assessment

• Quick checks: Use OpenSSL to view the certificate chain and expiry date. openssl s_client -connect example.com:443 Look for the “validityNotAfter” field in the output.
• Scanning: Qualys SSL Labs can assess SSL configurations, including certificate validity (https://www.ssllabs.com/ssltest/). Nessus plugin ID 82796 identifies expiring certificates. These are examples only.
• Logs and evidence: Web server logs may show TLS handshake failures related to certificate errors. Check for events indicating “certificate expired” or similar messages.

openssl s_client -connect example.com:443

4. Solution / Remediation Steps

Renew any soon-to-expire SSL certificates to resolve the issue. Follow these steps carefully.

4.1 Preparation

• Ensure you have a valid Certificate Signing Request (CSR) and access to your Certificate Authority (CA). A roll back plan involves restoring the original certificates.
• A change window may be needed, depending on service impact. Approval from the security team is recommended.

4.2 Implementation

1. Step 1: Generate a new CSR using your web server’s tools (e.g., openssl req -new -keyout example.key -out example.csr).
2. Step 2: Submit the CSR to your CA and obtain a signed certificate.
3. Step 3: Install the new certificate on your web server, configuring it correctly for HTTPS.
4. Step 4: Restart the web server or relevant service to load the new certificate.

4.3 Config or Code Example

Before

# Apache configuration example (old certificate)
SSLCertificateFile /etc/ssl/certs/old_certificate.pem

After

# Apache configuration example (new certificate)
SSLCertificateFile /etc/ssl/certs/new_certificate.pem

4.4 Security Practices Relevant to This Vulnerability

Several security practices help prevent this issue.

• Practice 1: Implement a certificate lifecycle management process, including automated renewal reminders.

4.5 Automation (Optional)

Automated certificate renewal using Let’s Encrypt can help.

# Example Bash script for automated Let's Encrypt renewal with Certbot
certbot renew --non-interactive --agree-tos --email [email protected]

5. Verification / Validation

Confirm the fix by checking the new certificate’s expiry date and testing service functionality.

• Post-fix check: Use OpenSSL again to verify the “validityNotAfter” field shows a future date. openssl s_client -connect example.com:443
• Re-test: Re-run the earlier OpenSSL command and confirm the expiry date is now valid.
• Smoke test: Access the website via HTTPS to ensure it loads correctly without certificate errors. Test key user actions like login or submitting forms.
• Monitoring: Monitor web server logs for TLS handshake successes, indicating successful certificate validation.

openssl s_client -connect example.com:443

6. Preventive Measures and Monitoring

Update security baselines and implement automated checks to prevent recurrence.

• Baselines: Update your security baseline or policy to include a requirement for regular certificate expiry checks (for example, CIS control 14).
• Pipelines: Add checks in CI/CD pipelines to validate SSL certificates during deployment.
• Asset and patch process: Review SSL certificates as part of routine asset management. A quarterly review cycle is sensible.

7. Risks, Side Effects, and Roll Back

Incorrect certificate installation can cause service outages.

• Risk or side effect 2: Browser compatibility issues with newer certificate types are possible, though rare. Mitigation: Check browser support for chosen certificate type.
• Roll back: Restore the original certificate files and web server configuration. Restart the web service.

8. References and Resources

Links to official advisories and documentation.

• Vendor advisory or bulletin: [https://letsencrypt.org/docs/](https://letsencrypt.org/docs/)
• NVD or CVE entry: No specific CVE for this general issue, but search NVD for SSL certificate related vulnerabilities (https://nvd.nist.gov/).
• Product or platform documentation relevant to the fix: Apache SSL configuration guide (https://httpd.apache.org/docs/2.4/ssl/).