<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr"><br></div><div dir="ltr">Day #1 reports coming in:</div><div dir="ltr"><br></div><div dir="ltr"><a href="https://www.zdnet.com/article/fortinet-shopify-others-report-issues-after-root-ca-certificate-from-lets-encrypt-expires/">https://www.zdnet.com/article/fortinet-shopify-others-report-issues-after-root-ca-certificate-from-lets-encrypt-expires/</a></div><div dir="ltr"><br></div><div dir="ltr">“H<span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%; background-color: rgb(255, 255, 255);">elme told ZDNet that he confirmed issues with Palo Alto, Bluecoat, Cisco Umbrella, </span><a href="https://status.catchpoint.com/incidents/f5yl89kygf12" target="_blank" rel="noopener noreferrer nofollow" data-component="externalLink" style="text-decoration: none; cursor: pointer; color: rgb(17, 116, 199); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%;">Catchpoint</a><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%; background-color: rgb(255, 255, 255);">, Guardian Firewall, Monday.com, PFsense, Google Cloud Monitoring, Azure Application Gateway, OVH, Auth0, </span><a href="https://www.shopifystatus.com/incidents" target="_blank" rel="noopener noreferrer nofollow" data-component="externalLink" style="text-decoration: none; cursor: pointer; color: rgb(17, 116, 199); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%;">Shopify</a><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%; background-color: rgb(255, 255, 255);">, Xero, QuickBooks, Fortinet, Heroku, Rocket League, InstaPage, Ledger, </span><a href="https://answers.netlify.com/t/ways-to-work-around-ssl-caused-build-failures-server-certificate-verification-failed/44945" target="_blank" rel="noopener noreferrer nofollow" data-component="externalLink" style="text-decoration: none; cursor: pointer; color: rgb(17, 116, 199); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%;">Netlify</a><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%; background-color: rgb(255, 255, 255);">and Cloudflare Pages, but noted that there may be more.”</span></div><div dir="ltr"><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%; background-color: rgb(255, 255, 255);"><br></span></div><div dir="ltr"><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20); font-family: "Proxima Nova ZD", sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%; background-color: rgb(255, 255, 255);">Mark</span></div><div dir="ltr"><br><div dir="ltr"></div><blockquote type="cite">On 30 Sep 2021, at 2:02 PM, Michael Balzer <dexter@expeedo.de> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Scott Helme has written some excellent articles on this:<br>
<ul>
<li><a class="moz-txt-link-freetext" href="https://scotthelme.co.uk/lets-encrypt-to-transition-to-isrg-root/">https://scotthelme.co.uk/lets-encrypt-to-transition-to-isrg-root/</a></li>
<li><a class="moz-txt-link-freetext" href="https://scotthelme.co.uk/lets-encrypt-old-root-expiration/">https://scotthelme.co.uk/lets-encrypt-old-root-expiration/</a><br>
</li>
</ul>
Regards,<br>
Michael<br>
<br>
<br>
<div class="moz-cite-prefix">Am 30.09.21 um 07:02 schrieb Mark
Webb-Johnson:<br>
</div>
<blockquote type="cite" cite="mid:408951DA-5164-4444-BB72-B8DEF1D58486@webb-johnson.net">
<pre class="moz-quote-pre" wrap="">Brian,
Let’s Encrypt say that because there are a lot of embedded devices that do not update firmware / trusted CA lists, they did it this way. They are also worried about older Android devices that can’t be updated.
IMHO, they made a bigger mess of it by using cross-signing and introducing SSL/TLS library compatibility issues. The X3 trusted CA cert that was expiring could have simply been renewed without requiring a new one, and maintaining compatibility and a smooth transition. These CA certs are self-signed anyway, so you can do whatever you want with them (and I’ve done the 10 year re-sign twice already for my day-job primary CA).
Regards, Mark.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On 30 Sep 2021, at 12:42 PM, HONDA S2000 <a class="moz-txt-link-rfc2396E" href="mailto:s2000@audiobanshee.com"><s2000@audiobanshee.com></a> wrote:
Sorry to jump in the middle (end?) of a long thread...
Working on another system at work a couple of years ago with embedded security, I recall a couple of topics from the design meetings.
1) Certificate handling should be designed to allow for a transition period where two equivalent certificates are valid at the same time. That's because it's almost impossible to roll out a certificate change in the deployed fleet if only one can be valid at a time. The duration of the overlap needs to be long enough for all systems to transition, and only then can the old certs be removed.
2) Intermediate certificates are what enables these changes. The top or root cert is usually too protected to allow easy changes, or managed by another entity, so the team / project gets an intermediate that can be used to sign multiple leaf certs with varying expirations.
Leaf certs change relatively quickly, while intermediates change relatively infrequently. In both cases, some overlap time needs to be supported. I suppose this means that the root cert also needs a plan for transition that doesn't abruptly cut off all working systems.
Unfortunately, you probably already know all of this, and I'm just not familiar with how OVMS handles certs. But basically, I'm wondering whether a smoother transition can be designed around the *next* expiration. ... or is this something that Let's Encrypt didn't plan for?
Brian Willoughby
_______________________________________________
OvmsDev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OvmsDev@lists.openvehicles.com">OvmsDev@lists.openvehicles.com</a>
<a class="moz-txt-link-freetext" href="http://lists.openvehicles.com/mailman/listinfo/ovmsdev">http://lists.openvehicles.com/mailman/listinfo/ovmsdev</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">_______________________________________________
OvmsDev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OvmsDev@lists.openvehicles.com">OvmsDev@lists.openvehicles.com</a>
<a class="moz-txt-link-freetext" href="http://lists.openvehicles.com/mailman/listinfo/ovmsdev">http://lists.openvehicles.com/mailman/listinfo/ovmsdev</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26</pre>
<span>_______________________________________________</span><br><span>OvmsDev mailing list</span><br><span>OvmsDev@lists.openvehicles.com</span><br><span>http://lists.openvehicles.com/mailman/listinfo/ovmsdev</span><br></div></blockquote></body></html>