3 ms·
If the device is still supported and getting updates this shouldn't be an issue (just remove the compromised CA from the trust store). If it is not supported, i
by abiogenesis 6y ago
If the device is still supported and getting updates this shouldn't be an issue (just remove the compromised CA from the trust store). If it is not supported, it is still better than having a brick.
- goalieca 6y agoThere’s a catch 22 for signed binaries that use PKI where you can’t install the firmware update without verifying the signature.
- grishka 6y agoWell, then you have to set the system time to back when the certificate was valid.
- abiogenesis 6y agoA compromised CA is still valid, so you should be able to replace it with a non-compromised one before the expiry date.
- huslage 6y agoDevices with limited resources often do not have a "Trust store" in the sense that an like Linux has one. Often keys are embedded within code directly and updating software in these devices can be difficult if not impossible.
- abiogenesis 6y agoIn that case it makes even more sense to ignore the expiry date as the vendor is not able to renew or replace it anyway.