Repository navigation
[DigiCert] 2FA will be turned on for your account #3453
Description
New email arrived. topic: [Security Announcement] Two-Factor Authentication will be turned on for your account. Seems like we need to do some manual actions
Context
...
Starting August 14, 2023, at 9:00 MDT (15:00 UTC), you must use your credentials and a one-time password to access your CertCentral account.
What do I need to do?
- Log in to your CertCentral account and set up your one-time password (OTP) device.
- Additionally, you can update your two-factor authentication settings if needed.
For example, you can set up rules for specific users requiring them to user a client certificate as the second form of authentication instead of a one-time password. See our CertCentral two-factor authentication guide.
Next steps
- Accomplish the 2FA setup
- Update the documentation and secrets in the private repository
Activity
RafaelGSS commentedon Aug 16, 2023
For which workflow do we need it?
UlisesGascon commentedon Aug 16, 2023
My fault, @RafaelGSS 🤦♂️. I will transfer the issue to the build team
richardlau commentedon Aug 22, 2023
FWIW this account is, I believe, used for the current Windows Authenticode code-signing certificate (see #2415). The certificate itself, as well as update instructions, is stashed in the secrets repo under
build/releasewith the account username/password in the usual admin logins file underbuild/infra.As an aside our current certificate expires in December this year. From the Node.js 20.5.0 Windows binary:
mhdawson commentedon Aug 23, 2023
@richardlau while you were in there, could you tell if we can get the 2FA seed so that we can store in screts so all appropriate build team members can get access?
richardlau commentedon Aug 23, 2023
@mhdawson I've never attempted to log into the account.
mhdawson commentedon Nov 29, 2023
@bensternthal can you confirm this is not the same account that was used to create our new certificates? The email was sent to build@iojs.org.
bensternthal commentedon Nov 29, 2023
@mhdawson I checked both DigiCert and DigiCert One and we did not create any accounts with the build@iojs.org. We started from scratch. So the account referenced in this thread is not related to the new certificates.
mhdawson commentedon Nov 30, 2023
Logged in and set up 2FA - https://github.com/nodejs-private/secrets/pull/297 adds the info people will need to set up 2fa as well.
This is the account we used for the last microsoft signing certificate which expires in ~30 days. After that we probably don't need the account anymore as the new certificate was generated out of an account managed by the OpenJS Foundation.
mhdawson commentedon Nov 30, 2023
@bensternthal thanks for confirming.