<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
Everyone,<br>
<br>
the DST root certificate we include (DST Root CA X3) expires on
September 30, i.e. in two days.<br>
<br>
<font face="monospace">OVMS# tls trust list <br>
DST Root CA X3 length 1200 bytes<br>
1200 byte certificate: DST Root CA X3<br>
cert. version : 3<br>
serial number :
44:AF:B0:80:D6:A3:27:BA:89:30:39:86:2E:F8:40:6B<br>
issuer name : O=Digital Signature Trust Co., CN=DST Root
CA X3<br>
subject name : O=Digital Signature Trust Co., CN=DST Root
CA X3<br>
issued on : 2000-09-30 21:12:19<br>
<b> expires on : 2021-09-30 14:01:15</b><br>
signed using : RSA with SHA1<br>
RSA key size : 2048 bits<br>
basic constraints : CA=true<br>
key usage : Key Cert Sign, CRL Sign</font><br>
<br>
AFAICT, this root certificate is currently used by the OVMS to
validate Let's Encrypt certificates.<br>
<ul>
<li><a class="moz-txt-link-freetext" href="https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/">https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/</a></li>
<li><a class="moz-txt-link-freetext" href="https://letsencrypt.org/docs/certificate-compatibility/">https://letsencrypt.org/docs/certificate-compatibility/</a><br>
</li>
</ul>
Unfortunately, we missed adding the followup LE root certificate
"ISRG Root X1" in time.<br>
<br>
I've just added that certificate to our builtin certificate
repository, but it's too late now to roll out a "main" update in
time (isn't it?).<br>
<br>
So, to prevent losing TLS connectivity with LE servers, users need
to manually add the ISRG Root X1 certificate to their TLS
repositories.<br>
<br>
I've added a section on this to our user manual:<br>
<ul>
<li><a class="moz-txt-link-freetext" href="https://docs.openvehicles.com/en/latest/userguide/ssltls.html">https://docs.openvehicles.com/en/latest/userguide/ssltls.html</a></li>
</ul>
If users contact you, point them to that page.<br>
<br>
We probably should also remove the expired DST root certificate
after September 30.<br>
<br>
Regards,<br>
Michael<br>
<br>
<pre class="moz-signature" cols="72">--
Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26</pre>
</body>
</html>