<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks and kudos to the OVMS Development Leadership for staying in front of this. It is very much appreciated.<div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 1, 2021, at 1:56 PM, Michael Balzer <<a href="mailto:dexter@expeedo.de" class="">dexter@expeedo.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" class="">
<div class="">
Looks like we managed to mitigate this just in time. I've had only
one user who didn't get the update before the expiration. Another
one reported Firefox wouldn't open my website anymore, it turned out
he was using some Firefox version well below 50 and wasn't willing
to update, because he didn't like the UI changes of newer releases…<br class="">
<br class="">
The Let's Encrypt forum is running hot with users having issues. I
think this could have been communicated in a better way.<br class="">
<br class="">
Regards,<br class="">
Michael<br class="">
<br class="">
<br class="">
<div class="moz-cite-prefix">Am 01.10.21 um 09:03 schrieb Mark
Webb-Johnson:<br class="">
</div>
<blockquote type="cite" cite="mid:3B10AABB-375F-46CB-91D8-783D7CFA940E@webb-johnson.net" class="">
<meta http-equiv="content-type" content="text/html; charset=UTF-8" class="">
<div dir="ltr" class=""><br class="">
</div>
<div dir="ltr" class="">Day #1 reports coming in:</div>
<div dir="ltr" class=""><br class="">
</div>
<div dir="ltr" class=""><a href="https://www.zdnet.com/article/fortinet-shopify-others-report-issues-after-root-ca-certificate-from-lets-encrypt-expires/" moz-do-not-send="true" class="">https://www.zdnet.com/article/fortinet-shopify-others-report-issues-after-root-ca-certificate-from-lets-encrypt-expires/</a></div>
<div dir="ltr" class=""><br class="">
</div>
<div dir="ltr" class="">“H<span style="caret-color: rgb(8, 14, 20); color:
rgb(8, 14, 20); font-family: "Proxima Nova ZD",
sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%;
background-color: rgb(255, 255, 255);" class="">elme told ZDNet that he
confirmed issues with Palo Alto, Bluecoat, Cisco Umbrella, </span><a href="https://status.catchpoint.com/incidents/f5yl89kygf12" target="_blank" rel="noopener noreferrer nofollow" data-component="externalLink" style="text-decoration: none;
cursor: pointer; color: rgb(17, 116, 199); font-family:
"Proxima Nova ZD", sans-serif; font-size: 18px;
-webkit-text-size-adjust: 100%;" moz-do-not-send="true" class="">Catchpoint</a><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20);
font-family: "Proxima Nova ZD", sans-serif;
font-size: 18px; -webkit-text-size-adjust: 100%;
background-color: rgb(255, 255, 255);" class="">, Guardian Firewall,
<a href="http://Monday.com" class="">Monday.com</a>, PFsense, Google Cloud Monitoring, Azure
Application Gateway, OVH, Auth0, </span><a href="https://www.shopifystatus.com/incidents" target="_blank" rel="noopener noreferrer nofollow" data-component="externalLink" style="text-decoration: none;
cursor: pointer; color: rgb(17, 116, 199); font-family:
"Proxima Nova ZD", sans-serif; font-size: 18px;
-webkit-text-size-adjust: 100%;" moz-do-not-send="true" class="">Shopify</a><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20);
font-family: "Proxima Nova ZD", sans-serif;
font-size: 18px; -webkit-text-size-adjust: 100%;
background-color: rgb(255, 255, 255);" class="">, Xero, QuickBooks,
Fortinet, Heroku, Rocket League, InstaPage, Ledger, </span><a href="https://answers.netlify.com/t/ways-to-work-around-ssl-caused-build-failures-server-certificate-verification-failed/44945" target="_blank" rel="noopener noreferrer nofollow" data-component="externalLink" style="text-decoration: none;
cursor: pointer; color: rgb(17, 116, 199); font-family:
"Proxima Nova ZD", sans-serif; font-size: 18px;
-webkit-text-size-adjust: 100%;" moz-do-not-send="true" class="">Netlify</a><span style="caret-color: rgb(8, 14, 20); color: rgb(8, 14, 20);
font-family: "Proxima Nova ZD", sans-serif;
font-size: 18px; -webkit-text-size-adjust: 100%;
background-color: rgb(255, 255, 255);" class="">and Cloudflare Pages,
but noted that there may be more.”</span></div>
<div dir="ltr" class=""><span style="caret-color: rgb(8, 14, 20); color:
rgb(8, 14, 20); font-family: "Proxima Nova ZD",
sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%;
background-color: rgb(255, 255, 255);" class=""><br class="">
</span></div>
<div dir="ltr" class=""><span style="caret-color: rgb(8, 14, 20); color:
rgb(8, 14, 20); font-family: "Proxima Nova ZD",
sans-serif; font-size: 18px; -webkit-text-size-adjust: 100%;
background-color: rgb(255, 255, 255);" class="">Mark</span></div>
<div dir="ltr" class=""><br class="">
<blockquote type="cite" class="">On 30 Sep 2021, at 2:02 PM, Michael
Balzer <a class="moz-txt-link-rfc2396E" href="mailto:dexter@expeedo.de"><dexter@expeedo.de></a> wrote:<br class="">
<br class="">
</blockquote>
</div>
<blockquote type="cite" class="">
<div dir="ltr" class="">
<meta http-equiv="Content-Type" content="text/html;
charset=UTF-8" class="">
Scott Helme has written some excellent articles on this:<br class="">
<ul class="">
<li class=""><a class="moz-txt-link-freetext" href="https://scotthelme.co.uk/lets-encrypt-to-transition-to-isrg-root/" moz-do-not-send="true">https://scotthelme.co.uk/lets-encrypt-to-transition-to-isrg-root/</a></li>
<li class=""><a class="moz-txt-link-freetext" href="https://scotthelme.co.uk/lets-encrypt-old-root-expiration/" moz-do-not-send="true">https://scotthelme.co.uk/lets-encrypt-old-root-expiration/</a><br class="">
</li>
</ul>
Regards,<br class="">
Michael<br class="">
<br class="">
<br class="">
<div class="moz-cite-prefix">Am 30.09.21 um 07:02 schrieb Mark
Webb-Johnson:<br class="">
</div>
<blockquote type="cite" cite="mid:408951DA-5164-4444-BB72-B8DEF1D58486@webb-johnson.net" class="">
<pre class="moz-quote-pre" wrap="">Brian,
Let’s Encrypt say that because there are a lot of embedded devices that do not update firmware / trusted CA lists, they did it this way. They are also worried about older Android devices that can’t be updated.
IMHO, they made a bigger mess of it by using cross-signing and introducing SSL/TLS library compatibility issues. The X3 trusted CA cert that was expiring could have simply been renewed without requiring a new one, and maintaining compatibility and a smooth transition. These CA certs are self-signed anyway, so you can do whatever you want with them (and I’ve done the 10 year re-sign twice already for my day-job primary CA).
Regards, Mark.
</pre>
<blockquote type="cite" class="">
<pre class="moz-quote-pre" wrap="">On 30 Sep 2021, at 12:42 PM, HONDA S2000 <a class="moz-txt-link-rfc2396E" href="mailto:s2000@audiobanshee.com" moz-do-not-send="true"><s2000@audiobanshee.com></a> wrote:
Sorry to jump in the middle (end?) of a long thread...
Working on another system at work a couple of years ago with embedded security, I recall a couple of topics from the design meetings.
1) Certificate handling should be designed to allow for a transition period where two equivalent certificates are valid at the same time. That's because it's almost impossible to roll out a certificate change in the deployed fleet if only one can be valid at a time. The duration of the overlap needs to be long enough for all systems to transition, and only then can the old certs be removed.
2) Intermediate certificates are what enables these changes. The top or root cert is usually too protected to allow easy changes, or managed by another entity, so the team / project gets an intermediate that can be used to sign multiple leaf certs with varying expirations.
Leaf certs change relatively quickly, while intermediates change relatively infrequently. In both cases, some overlap time needs to be supported. I suppose this means that the root cert also needs a plan for transition that doesn't abruptly cut off all working systems.
Unfortunately, you probably already know all of this, and I'm just not familiar with how OVMS handles certs. But basically, I'm wondering whether a smoother transition can be designed around the *next* expiration. ... or is this something that Let's Encrypt didn't plan for?
Brian Willoughby
_______________________________________________
OvmsDev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OvmsDev@lists.openvehicles.com" moz-do-not-send="true">OvmsDev@lists.openvehicles.com</a>
<a class="moz-txt-link-freetext" href="http://lists.openvehicles.com/mailman/listinfo/ovmsdev" moz-do-not-send="true">http://lists.openvehicles.com/mailman/listinfo/ovmsdev</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">_______________________________________________
OvmsDev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OvmsDev@lists.openvehicles.com" moz-do-not-send="true">OvmsDev@lists.openvehicles.com</a>
<a class="moz-txt-link-freetext" href="http://lists.openvehicles.com/mailman/listinfo/ovmsdev" moz-do-not-send="true">http://lists.openvehicles.com/mailman/listinfo/ovmsdev</a>
</pre>
</blockquote>
<br class="">
<pre class="moz-signature" cols="72">--
Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26</pre>
<span class="">_______________________________________________</span><br class="">
<span class="">OvmsDev mailing list</span><br class="">
<span class=""><a class="moz-txt-link-abbreviated" href="mailto:OvmsDev@lists.openvehicles.com">OvmsDev@lists.openvehicles.com</a></span><br class="">
<span class=""><a class="moz-txt-link-freetext" href="http://lists.openvehicles.com/mailman/listinfo/ovmsdev">http://lists.openvehicles.com/mailman/listinfo/ovmsdev</a></span><br class="">
</div>
</blockquote>
<br class="">
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
OvmsDev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OvmsDev@lists.openvehicles.com">OvmsDev@lists.openvehicles.com</a>
<a class="moz-txt-link-freetext" href="http://lists.openvehicles.com/mailman/listinfo/ovmsdev">http://lists.openvehicles.com/mailman/listinfo/ovmsdev</a>
</pre>
</blockquote>
<br class="">
<pre class="moz-signature" cols="72">--
Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26</pre>
</div>
_______________________________________________<br class="">OvmsDev mailing list<br class=""><a href="mailto:OvmsDev@lists.openvehicles.com" class="">OvmsDev@lists.openvehicles.com</a><br class="">http://lists.openvehicles.com/mailman/listinfo/ovmsdev<br class=""></div></blockquote></div><br class=""></div></body></html>