The viewer has 3 expired certs

[Dan-Linden]

Environment

Second Life Release 7.1.15.15596336374 (64bit)
Windows and Mac

Description

The viewer has 3 expired certs.

Reproduction steps

1. Start the Release viewer 7.1.15.15596336374
2. Search the SecondLife.log for Certificate.

Observed: There are 3 Certificate Errors

2025-08-08T20:15:45Z WARNING #SECAPI# newview/llsecapi.cpp(168) LLCertException::LLCertException : Certificate Error: CertExpired
2025-08-08T20:15:45Z WARNING #SECAPI# newview/llsecapi.cpp(168) LLCertException::LLCertException : Certificate Error: CertExpired
2025-08-08T20:15:45Z WARNING #SECAPI# newview/llsecapi.cpp(168) LLCertException::LLCertException : Certificate Error: CertExpired
2025-08-08T20:15:45Z INFO #SECAPI# newview/llsechandler_basic.cpp(629) LLBasicCertificateStore::load_from_file : loaded 145 good certificates (rejected 3) from C:\\Program Files\\SecondLifeViewer\\ca-bundle.crt

Expected: We should keep these up to date.

---

This repo is using Opire - what does it mean? 👇

💵 Everyone can add rewards for this issue commenting /reward 100 (replace 100 with the amount).
🕵️‍♂️ If someone starts working on this issue to earn the rewards, they can comment /try to let everyone know!
🙌 And when they open the PR, they can comment /claim #4505 either in the PR description or in a PR's comment.

🪙 Also, everyone can tip any user commenting /tip 20 @Dan-Linden (replace 20 with the amount, and @Dan-Linden with the user to tip).

📖 If you want to learn more, check out our documentation.

[bennettgoble]

At this point we can probably totally drop the llca dependency and have Second Life rely on the system cert chain...? We no longer need to install a self-signed CA. :)

[fmartian]

At this point we can probably totally drop the llca dependency and have Second Life rely on the system cert chain...? We no longer need to install a self-signed CA.

Yes, except that each system store is quite different. I did work in the last days on some solution to that here: https://github.com/fmartian/secondlife_viewer/tree/SystemSecStore

It compiles and works on Windows and I'm busy getting my Mac and a Linux system setup so I can test it there too. The current implementation was the most easy to fix into the existing class hierarchy but I'm not fully happy with the current solution as I feel it should instead be a specialization of the the LLBasicCertificateVector as LLFileCertificateVector that derives from the LLBasicCertificateVector and another one as LLSystemCertificateVector that derives from the LLFileCertificateVector so it can reuse the load_from_file() and they then implement the actual loading of the certificates from the relevant source.