[debian-edu-commits] [Debian Wiki] Update of "DebianEdu/Documentation/Trixie/Upgrades" by DanielTeichmann

[Debian Wiki]

Dear Wiki user,

You have subscribed to a wiki page or wiki category on "Debian Wiki" for change notification.

The "DebianEdu/Documentation/Trixie/Upgrades" page has been changed by DanielTeichmann:
https://wiki.debian.org/DebianEdu/Documentation/Trixie/Upgrades?action=diff&rev1=2&rev2=3

Comment:
Debian Edu 13+ clients do not support legacy pre-OpenSSLv3 created certs!

  cf-agent -v -D installation
  }}}
  
+  * Certificates generated by older Debian Edu releases lack the X.509 extensions required by OpenSSLv3 and are '''incompatible with Debian Edu 13+ clients'''.
+  Administrators who manually upgrade the main server must therefore regenerate them using the certificate defaults introduced in Debian Edu 13.
+  The default key algorithm was changed to ECDSA using the {{{prime256v1}}} curve. RSA-2048 itself remains supported by OpenSSLv3 though.
+  See [[https://salsa.debian.org/debian-edu/debian-edu-config/-/merge_requests/44|!44]] and [[https://salsa.debian.org/debian-edu/debian-edu-config/-/merge_requests/40|!40]] for further technical information.
+    Before continuing though, back up the existing certificate files. The archive contains private keys and must be kept secure.
+   {{{
+     $ (umask 077 && cd / && tar -vczf /root/debian-edu_RSA-certs_backup_pre-ECDSA.tar.gz etc/ssl/private/[Dd]ebian-[Ee]du* etc/ssl/certs/[Dd]ebian-[Ee]du* etc/debian-edu/www/[Dd]ebian-[Ee]du* usr/local/share/ca-certificates/[Dd]ebian-[Ee]du*)
+   }}}
+   '''This replaces the Debian Edu root CA. The new root CA must be distributed to all clients again, using {{{/usr/share/debian-edu-config/tools/fetch-rootca-cert}}} on the clients.'''
+   {{{
+     $ /usr/share/debian-edu-config/tools/create-debian-edu-certs --force-overwrite
+   }}}
+   To restore the server-side certificate files from the archive:
+   {{{
+     $ tar -vxzf /root/debian-edu_RSA-certs_backup_pre-ECDSA.tar.gz -C /
+   }}}
+   Restoring the archive only restores the server-side certificate files. It does not undo distribution of the new root CA to clients.
+ 
   * Check if the upgraded system works:
  
  Reboot; log in as first user and test