OSS root certificate upgrade 2024/03
A root certificate is the foundation of the SSL/TLS trust chain, used to verify the authenticity of a server certificate. Due to changes in global root certificate trust policies, Object Storage Service (OSS) is upgrading its root certificates to ensure continued security and availability of HTTPS access.
Background
In early 2023, Mozilla implemented a new root certificate trust policy. This policy distrusts server authentication root certificates older than 15 years. As a result, the GlobalSign Root R1 root certificate will expire on April 15, 2025. For more information, see Mozilla's Root CA Lifecycles policy.
OSS response plan
Alibaba Cloud OSS has taken the following measures to ensure a smooth transition. For more information, see the Announcement on Updating OSS SSL Certificates.
Action | Description |
Certificate update | Starting July 1, 2024, new certificates issued by OSS will use GlobalSign Root R3 to ensure compliance with the latest security standards. |
Cross-certificate compatibility | Existing certificates will transition smoothly from R1 to R3 through a cross-certificate mechanism. The cross-certificate is valid until January 28, 2028. We recommend completing preparations for the update before December 28, 2026. |
Future planning | GlobalSign Root R3 will no longer be trusted by Mozilla starting April 15, 2027, and will expire on March 18, 2029. We recommend that your client's root certificate list include multiple root certificates, such as R1, R3, R6, and R46, to prepare for future certificate rotations. |
What you need to do
Most users do not need to take any action. Modern operating systems (Windows 7+, macOS 10.12.1+, and major Linux distributions from the last five years) and browsers automatically update their built-in trusted root certificate store.
You only need to follow the steps below if you use an older operating system, an embedded device, or a custom client with an outdated root certificate store, and you encounter certificate errors when accessing OSS over HTTPS.
Step 1: Check for the GlobalSign R3 certificate
Windows
Press Win + R, enter
certmgr.msc, and press Enter to open Certificate Manager.In the left-side navigation pane, expand .
In the list, find the certificate with an Issued To value of GlobalSign and a Friendly Name of GlobalSign Root CA - R3.
Linux
On Ubuntu, for example, open a terminal and run the following command to check if any GlobalSign certificates exist in the system certificate directory:
ls /etc/ssl/certs/ | grep GlobalSignmacOS
Open Finder, search for and open Keychain Access.
Click System Roots, enter "GlobalSign" in the search box, and double-click the certificate to view its details.
Step 2: Install the missing root certificate
If the root certificate is missing from your system, see Install a root certificate on an operating system.