CC3220SF-LAUNCHXL: Cloud OTA for Github seems broken as it requires two different Root CA Cert.

Leo Choi1

I made a search for the Cloud OTA problem, i found TI has an annoument for the Dropbox OTA broken issue.
I found similar issue for the Github too. Can TI confirm this problem? And will this be fixed too?
e2e.ti.com/.../faq-simplelink-cc32xx-sdk-important-notice-for-customers-using-dropbox-for-ota-updates

When I tried to execute the ota code today, it returns below error from api.github.com.

OTA_run: call CdnClient_ConnectServer OTA server=api.github.com
CdnClient_ConnectServer: HttpClient_Connect api.github.com
[SOCK ERROR] an event received on socket 4
[SOCK ERROR] Used wrong CA to verify the peer.
[SOCK ERROR] Use Following Root CA.
[SOCK ERROR] DigiCert Global Root CA
[SOCK EVENT] - Unexpected Event [20x]

Then, I add the DigiCert Global Root CA to the code and replace the High Assurance CA
It return following error from raw.githubusercontent.com

//#define OTA_SERVER_ROOT_CA_CERT         "DigCert_High_Assurance_CA.der"
#define OTA_SERVER_ROOT_CA_CERT         "DigiCertGlobalRootCA.der"

OTA_run: Call CdnClient_ConnectFileServer, url = raw.githubusercontent.com/.../20210308103838_CC3220SF_GW2.0.tar
HttpClient_Connect: IP_ADDR=185.199.111.133
[SOCK ERROR] an event received on socket 13
[SOCK ERROR] Used wrong CA to verify the peer.
[SOCK ERROR] Use Following Root CA.
[SOCK ERROR] DigiCert High Assurance EV Root CA
[SOCK EVENT] - Unexpected Event [20x]

over 3 years ago

0 Leo Choi1 over 3 years ago

Prodigy 230 points

Additional screenshot for requirement of different server

+1 Michael Reymond over 3 years ago in reply to Leo Choi1

TI__Mastermind 40965 points

Hi,

I suspect that the same fix for Dropbox will work with Github as well. I will confirm with our testing team to ensure that Github use cases have been tested with the new OTA lib for SDK ver 5.10.

In the meantime, there is a workaround you can use. In the root CA pem file you provide to the library, you can actually concatenate and provide both Digicert certs. See my post here for more details:

https://e2e.ti.com/support/wireless-connectivity/wifi/f/wi-fi-forum/976387/cc3220sf-handling-dropbox-changing-certificates/3606776#3606776

Regards,

Michael

0 Leo Choi1 over 3 years ago in reply to Michael Reymond

Prodigy 230 points

Hi Micheal,

thanks. This workaround works temporarily. I hope TI can confirm next release of the SDK could have a better solution.

0 Michael Reymond over 3 years ago in reply to Leo Choi1

TI__Mastermind 40965 points

Hi,

Yes, I checked and the next SDK version will allow you to specify a separate root CA cert file for the main HTTP server vs the file server. So this will fix the issue for both Dropbox and Github.

Regards

Michael

0 Michael Fuhrmann over 3 years ago in reply to Michael Reymond

Intellectual 770 points

We are using GitHub. Seems like it is entirely possible an update needs pushing with new certificates to be able to perform an update. Looks suspiciously like the chicken and egg case. How are we suppose to be sure of an OTA that‘s not going to permanently brake ?

0 Michael Reymond over 3 years ago in reply to Michael Fuhrmann

TI__Mastermind 40965 points

Hi,

Yes, if GitHub changes their server cert chain before you have a chance to update devices without the new cert setup, then it will break your OTA mechanism.

So, you should either use the multiple root CA cert bundle, and provide that mechanism through an OTA before any GitHub changes occur, or monitor their service announcements so that if or when they do change their server cert you can push out an OTA that addresses the issue preemptively. GitHub should have temporarily rolled back their server cert changes, so that you still have the opportunity to push out updates to devices.

Regards,

Michael

0 Michael Fuhrmann over 3 years ago in reply to Michael Reymond

Intellectual 770 points

Thanks Michael,

considering how important OTA is, it would be extremely beneficial to everyone to have TI have it's own OTA server at our disposal. The integration between the two can lead to substantial stability and additional features.

0 Leo Choi1 over 3 years ago in reply to Michael Reymond

Prodigy 230 points

Hi Micheal,

Yes, GitHub did roll back the cert changes.

Secondly, I checked the ota lib of simplelink_cc32xx_sdk_5_10_00_02, it seems the ota lib is still OTA_LIB_2.0.0.7. It is not updated to support two different cert.

0 Michael Reymond over 3 years ago in reply to Leo Choi1

TI__Mastermind 40965 points

Hi,

Unfortunately, we were unable to include the OTA library changes in the latest 5.10 SDK update. For now, the official solution remains to use the multiple root CA bundle. It is imperative that you update any devices in the field so that it uses the new cert bundle, in case GitHub changes their server cert chain again.

This E2E post has more details on the situation:

https://e2e.ti.com/support/wireless-connectivity/wifi/f/wi-fi-forum/989758/faq-simplelink-cc32xx-sdk-important-notice-for-customers-using-github-for-ota-updates

Regards,

Michael

Wi-Fi

Wi-Fi forum

CC3220SF-LAUNCHXL: Cloud OTA for Github seems broken as it requires two different Root CA Cert.