[DigiCert] 2FA will be turned on for your account

[UlisesGascon]

New email arrived. topic: [Security Announcement] Two-Factor Authentication will be turned on for your account. Seems like we need to do some manual actions

Context

...
Starting August 14, 2023, at 9:00 MDT (15:00 UTC), you must use your credentials and a one-time password to access your CertCentral account.
What do I need to do?

1. Log in to your CertCentral account and set up your one-time password (OTP) device.
2. Additionally, you can update your two-factor authentication settings if needed.
   For example, you can set up rules for specific users requiring them to user a client certificate as the second form of authentication instead of a one-time password. See our CertCentral two-factor authentication guide.

Next steps

• Accomplish the 2FA setup
• Update the documentation and secrets in the private repository

[RafaelGSS]

For which workflow do we need it?

[UlisesGascon]

My fault, @RafaelGSS 🤦‍♂️. I will transfer the issue to the build team

[richardlau]

FWIW this account is, I believe, used for the current Windows Authenticode code-signing certificate (see #2415). The certificate itself, as well as update instructions, is stashed in the secrets repo under build/release with the account username/password in the usual admin logins file under build/infra.

As an aside our current certificate expires in December this year. From the Node.js 20.5.0 Windows binary:

[mhdawson]

@richardlau while you were in there, could you tell if we can get the 2FA seed so that we can store in screts so all appropriate build team members can get access?

[richardlau]

@mhdawson I've never attempted to log into the account.

[mhdawson]

@bensternthal can you confirm this is not the same account that was used to create our new certificates? The email was sent to build@iojs.org.

[bensternthal]

@mhdawson I checked both DigiCert and DigiCert One and we did not create any accounts with the build@iojs.org. We started from scratch. So the account referenced in this thread is not related to the new certificates.

[mhdawson]

Logged in and set up 2FA - https://github.com/nodejs-private/secrets/pull/297 adds the info people will need to set up 2fa as well.

This is the account we used for the last microsoft signing certificate which expires in ~30 days. After that we probably don't need the account anymore as the new certificate was generated out of an account managed by the OpenJS Foundation.

[mhdawson]

@bensternthal thanks for confirming.