Anyone know if the changes described here are likely to impact on node-RED users? I see that it makes particular reference to api's & IoT devices, but I don't really understand the implications...

Hello @Paul-Reed , Trying to make a long story short: there is at least one authority, which is trusted by everyone (in real there are more than one). The certificates, which are trusted/ created by this authority are therefore trusted by every client. If this organization now has to change his na…

I would guess that it might affect anything that doesn't update its valid root certificate store. Thankfully these issues are now few and far between. I would think that things like Mosquitto will be using 3rd-party TLS libraries which will reference an updatable store whether the credential store …

Hello @TotallyInformation , Just for my information: I think the problems can only occur on client side, if they do not have the new root certificates, because they do not know, if they can trust. I think the server (e.g. hosting node-red), which is providing a certificate to the client does not ne…

Hey Paul, You can also have a look ar their certificate chain , to see to which root certificate your server certificate belongs. Recently @geoffreydemaagd had an issue with my node-red-contrib-letsencrypt node. Reasen appeared to be that I store both the server certificate and the Letsencrypt int…

[image] BartButenaers: both the server certificate and the Letsencrypt intermediate certificate are stored into the cert.pem file. I should have a look whether clients with a new/old root certificate would run into troubles, due to an incomplete chain... Yes, I had similar problems about 18 m…

[image] Paul-Reed: Yes, I had similar problems about 18 months ago, so I always advise users to use the fullchain.pem certificate instead of the cert.pem to complete the chain. I'd forgotten about that but yes I also always use the fullchain. [image] Ranki: Am I right? I think you are…

[image] TotallyInformation: I think you are right but don't forget that the client can be on the server as well as the server Good point!

To be honest, I hadn't even thought about a desktop/mobile client because if you are using one of those that isn't being updated, you have much bigger problems!

[image] BartButenaers: an issue with my node-red-contrib-letsencrypt node This is the certificate chain that is setup by my letsencrypt node: [image] So yes indeed, I hope that my browsers (Android and Windows) will have the new root certificate in september. Of course I can always trust i…

Node-RED

Node-RED Forum

Let's encrypt root certificate change

General

Paul-Reed 18 May 2021 21:28 11

Same here using certbot

cert

Topic		Replies	Views
Failed to load resource: Unacceptable TLS certificate General	3	583	6 December 2021
Update on Node-RED SSL using Letsencrypt & Certbot General http-request , security	6	414	11 April 2023
Node-RED SSL using Letsencrypt & Certbot Share Your Projects security	56	21937	13 May 2021
Limit access to Node-RED via client certificates Share Your Projects security	8	625	24 December 2023
Expired cert on https://social.nodered.org/ General	3	163	6 April 2023

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Let's encrypt root certificate change

Related topics