IronKey S100, S200, and D200 devices trust the fewest Certificate Authorities. If you're in a hurry to replace your IronKey Enterprise Server (aka EMS On-Prem) SSL certificate supporting legacy S100, S200, and D200 devices, contact one of the Certificate Authorities below and ask for "SHA-2 SSL cert issued by SHA-1 root, or include the cross-signed chain bundle leading to SHA-1 root".

Many CAs have created cross-signed certificates for SSL cert customers needing backward compatibility to SHA-1 roots. Always ask your CA for cross-signed certificates leading to SHA-1 root.


Certificate Authority SSL products supporting IronKey S100, S200, D200:  (as of June 2020)

  • DigiCert: Standard SSL (Download the DIGICERTissuer.crt at the bottom of this page and rename it to issuer.crt before certificate upload.)
  • Entrust.net:  Standard SSL or EV Multi-Domain SSL (Download the ENTRUSTissuer.crt at the bottom of this page and rename it to issuer.crt before certificate upload.)
  • IdenTrust.com: Certificates - SSL


What follows is a brief explanation of certificates and encryption hashes and the impact on IronKey devices, for example using an Entrust SSL certificate and cross-signed chain bundle leading to SHA-1 root:


All SSL certificates exist in a certificate chain of parent/child.  The first parent is the "root Certificate Authority (CA)" and is self-signed.


The parent of each child is called the "issuer".  There can be multiple parents, called "intermediate", in the chain.  The last certificate is the "end-entity" SSL certificate and is the SSL certificate deployed on the webserver or Enterprise Server.


Each certificate has a (self) subject key identifier and (parent) authority key identifier.  This establishes the parent-child chain.


Human-readable certificate chain example (in the order they're provided to HTTPS clients:  server cert, intermediate(s), root).
Note each child's "authority key identifier" is the parent's "subject key identifier":


server cert:

-----------

Signature Algorithm: sha256WithRSAEncryption

    Issuer: CN=Entrust Certification Authority - L1K

    Subject: CN=my.ironkey.com

        X509v3 Subject Key Identifier:

            96:B8:FA:38:58:02:D6:D7:16:D8:B3:A2:C1:68:84:A0:EF:79:EB:E7


        X509v3 Authority Key Identifier:

            keyid:82:A2:70:74:DD:BC:53:3F:CF:7B:D4:F7:CD:7F:A7:60:C6:0A:4C:BF

    


intermediate:

------------

Signature Algorithm: sha256WithRSAEncryption

    Issuer: CN=Entrust Root Certification Authority - G2

    Subject: CN=Entrust Certification Authority - L1K

        X509v3 Subject Key Identifier:

            82:A2:70:74:DD:BC:53:3F:CF:7B:D4:F7:CD:7F:A7:60:C6:0A:4C:BF

        X509v3 Authority Key Identifier:

            keyid:6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB


cross-signed intermediate:

-------------------------

Signature Algorithm: sha256WithRSAEncryption

    Issuer: CN=Entrust Root Certification Authority

    Subject: CN=Entrust Root Certification Authority - G2

        X509v3 Subject Key Identifier:

            6A:72:26:7A:D0:1E:EF:7D:E7:3B:69:51:D4:6C:8D:9F:90:12:66:AB

        X509v3 Authority Key Identifier:

            keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D


root:

----

Signature Algorithm: sha1WithRSAEncryption

    Issuer: CN=Entrust Root Certification Authority

    Subject: CN=Entrust Root Certification Authority

        X509v3 Subject Key Identifier:

            68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D

        X509v3 Authority Key Identifier:

            keyid:68:90:E4:67:A4:A6:53:80:C7:86:66:A4:F1:F7:4B:43:FB:84:BD:6D



Anyone can create a Certificate Authority (CA) and begin issuing certificates. However, very few CAs are trusted. IronKey devices have a file of trusted CA certificates in the IronKey Unlocker partition called \Common\certs\iksiteca.crt. This list is referred to as a Trust Store. Web browsers, such as Chrome, and Firefox, have similar Trust Stores.


SHA-1 and SHA-2 are two different cryptographic hash methods for creating unique certificates. Older hash methods, like MD5, exist but have fallen out of use due to publicly understood cryptographic attacks on commodity hardware.


The SHA-1 hash output is 160 bits, but is widely considered susceptible to cryptographic attacks on very large compute platforms and has been removed from use for end-entity SSL certificates.


When someone refers to "SHA-2", they are referring to the entire family of SHA-2 hash functions with hash output that are 224, 256, 384 or 512 bits, denoted as SHA-224, SHA-256, SHA-384, SHA-512/224, and SHA-512/256 respectively.


The SSL certificate hashing method is the basis for the SSL traffic encryption. Put simply, the more bits in the hash, the stronger the encryption.


Notably, the root CA or intermediate CA certificate hash method has no bearing on the end-entity SSL certificate encryption strength. For example, a SHA-256 SSL certificate with a SHA-1 root CA parent will encrypt traffic with SHA-256 strength.


IronKey devices validate all SSL connections to IronKey EMS against the onboard Trust Store. The device verifies the IronKey EMS SSL certificate chain to find any trusted certificate in the chain (end-entity, intermediates, or root). The chain verification is done by checking each certificate's subject key identifier and authority key identifier to verify a complete root-intermediate(s)-end-entity certificate chain.


With the deprecation of SHA-1 based SSL certificates, a few Certificate Authorities (ex: GoDaddy) no longer issue SSL certs with SHA-1 root and are instead issuing SSL certs with SHA-2 root. This is problematic for nearly all IronKey devices in the field. Almost none will trust the SHA-2 root CAs.


Each IronKey device Unlocker partition has a human-readable list of supported Certificate Authority certificates. The supported certificates may differ by device type and device version.


- S100/S200/D200:  IronKey Unlocker:\Windows\certs\cacerts.pem

- all others:  IronKey Unlocker:\Common\certs\cacerts.pem


SHA-1 root* CA trust:

- ALL versions of all IronKey devices (S100, S200, D200, S250, D250, S1000, W300, W500, W700, H300, H350).


SHA-2 root** CA trust:

- S100: NOT SUPPORTED
- S200: NOT SUPPORTED
- D200: NOT SUPPORTED

- S250 v3.5.0.0 and higher

- D250 v3.5.0.0 and higher

- D300 v5.6.0 and higher

- S1000 v5.0.1.0 and higher

- W500 v4.3.0.1 and higher (excluding 4.3.1.0)

- W700 v4.3.0.1 and higher (excluding 4.3.1.0)

- H300 v5.2.0.0 and higher

- H350 v5.2.0.0 and higher


(*) - SHA-1 Supported Certificate Authority:  DigiCert, Entrust.net, IdenTrust/DST


(**) - SHA-2 Supported Certificate Authority:  Comodo, DigiCert, Entrust.net, IdenTrust/DST, GeoTrust, GlobalSign, GoDaddy, Thawte