Abstract
Bamboo Health uses modern TLSv1.2 or greater for all applications. Our TLS certificates are signed by universally accepted vendors, and our systems make use of automated PKI systems such as ACME (RFC 8555) where possible to update our certificates on a frequent basis per industry best practice (CA/B SC-063).
This page details all CAs used by our systems, and shares information on upcoming TLS-related changes.
Note: For systems that use automated PKI rotation, details on terminal/leaf certificate changes will not be shared, only information for upcoming root-related changes.
Trust Store and Certificate Pinning Recommendations
We recommend the use of an operating-system or programming language maintained trust store for all customers. Our CA vendors are universally trusted and and meet or exceed CCADB and CA/B forum baseline policies and requirements. The Mozilla CA certificate store can be used, and contains all root CAs we will use. If you must make use of custom trust stores, you must include all active use & deprecated CAs below. Inclusion of all below roots ensures maximum stability for your integration and reduces the likelihood of downtime.
We strongly discourage pinning, and refer all customers to current OWASP guidance around pinning:
While the idea of pinning is simple to talk about, it is very difficult to safely execute on. Considering the current risks in the CA and browser space and comparing them to the risk of down time, pinning is not recommended. Google, Microsoft, Apple, and Firefox control almost every trust store on every device on the planet and they wield this power with an eye on security as a competitive advantage.
If the client’s pinset and the server’s keys are not kept in sync in real-time, do not pin
If your information security standards require pinning, you must pin to all roots below. You should not depend on the certificate chain to remain the same after certificate rotations as our vendors may not reissue using the same root or intermediates.
Never pin to an intermediate CA certificate. We will not provide information about intermediate CA certificates on this page, and the intermediate CA certificate is subject to change without warning.
Never pin to the terminal/leaf certificate. This would place your system at high risk for outages and service interruptions.
Supported TLS Versions
We fully support modern TLSv1.3 and will fallback to TLSv1.2 for legacy systems. Versions of TLS less than v1.2 are not supported as these have been deprecated since 2021.
Customers should ensure their operating systems are fully updated to their latest version to ensure maximum support for TLSv1.3 and TLSv1.2. We strongly discourage any client-side restriction for TLS versions.
TLS Ciphersuite Information
The following ciphers are supported by all of our systems. Ciphers are identified by IANA names.
TLS_AES_128_GCM_SHA256TLS_AES_256_GCM_SHA384TLS_CHACHA20_POLY1305_SHA256TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
These ciphers are defined in RFC 5289 and RFC 8446. They represent a balance between maximum backwards compatibility and modern security.
Customers should ensure their operating systems are fully updated to their latest version to ensure maximum support for TLSv1.3 and TLSv1.2. We strongly discourage customers from manually specifying ciphersuites or attempting to force negotiation of a certain cipher.
Note: Certain systems may support additional ciphersuites. The suites identified above are our supported baseline.
CA Lifecycle at Bamboo Health
All CAs in use for our managed systems will follow the below lifecycle.
- Active use: these certificate authorities are actively present and used in our environment, and we will renew certificates / seek new issuances from them. Customers who pin to roots must pin all active use CA certificates.
- Deprecated: deprecated certificate authorities have signed certificates which are actively present and used in our environment. However, we will not plan to renew certificates issued by these vendors or seek new issuances from them. Customers who pin to roots must pin all deprecated CA certificates.
- Exited: exited certificate authorities have been used in the past to sign certificates in our environments. No active certificates are present in our environment signed by these providers. Customers do not need to include these CA certificates in their trust stores. These CAs are included for informational purposes only, and the list of exited CAs may not be comprehensive.
All lifecycle transitions (active use to deprecated, deprecated to exited) will be listed in the below root TLS changes list.