December 8, 2020 – Advisory: Expiring Certificate Authority Certificates
InterSystems has identified an issue with product distributions containing Certificate Authority certificates that expire at the end of 2020. This issue does not affect system operation or system security in any way, although it does generate alerts about expiring certificates in the cconsole.log or messages.log files. The messages may be ignored and there are instructions below to eliminate them.
The issue affects the following versions:
- Caché and Ensemble 2017.1, 2017.2, and 2018.1
- All released versions of InterSystems IRIS and InterSystems IRIS for Health
- HealthShare products based on the above versions
The System Monitor generates these messages because <install-dir>/dev/CACerts/AllCA.cer is referenced in ISC.FeatureTracker.SSL.Config. The file AllCA.cer contains certificates that expire at the end of 2020. Its use has been deprecated starting with Caché and Ensemble 2018.1.4, and IRIS 2020.1.0+.
The recommended mitigation is to remove or rename <install-dir>/dev/CACerts/AllCA.cer. Note that this file may be re-created if you upgrade an instance, so you may need to perform this mitigation step after each upgrade to or installation of an affected version. The expiring certificates will no longer be included in distributions starting with Caché and Ensemble 2018.1.5, IRIS 2019.1.2, and IRIS 2020.1.1.
Deleting this file does not affect any default InterSystems product functionality or the security of any provided software utilities. If your Caché or Ensemble application uses AllCA.cer or the ThawteCA.cer file (in the same directory), please contact the Worldwide Response Center (WRC) for assistance.
If you have any questions regarding this alert, please contact the Worldwide Response Center.
Example cconsole.log/messages.log entries (note that there may be variations depending on version):
These messages are generated at 11am each day, and after each restart.