Ticket Created
over 3 years ago

CIQQA-938

TLS certificate Issues on the Fenix 5 Plus

I recently posted a report related to a Sectigo SSL certificate's not validating on Fenix 7 / Epix gen 2 devices.

For the Fenix 5 Plus, things seems things much worse: Sectigo doesn't work, Let's Encrypt doesn't work, Amazon's root certificate used for Heroku apps doesn't work, and most surprisingly and importantly for me, the Digicert used by some S3 buckets isn't accepted. This is really surprising since Digicerts typically seem to be the gold standard (as far as these things go), so if that's not accepted, it seems like things have gone terribly wrong.

The CheckTLS app can be used to verify this, but you may want to patch it with other interesting root certs to verify their compliance.

I know the Fenix 5 Plus worked well in the past, but SSL certificates are a moving target, and there have been several high-profile moves recently. Amazon being the big one: going from Digicert to their own certs (but appearing to retain Digicert in some cases?).

rconradharris
  • over 3 years ago

    Another data point: pairing the Fenix 5 and Forerunner 645m with an iPhone appears to have updated the cert store on the watch because all the certs are green now. I confirmed this holds true even when Bluetooth on the phone is turned off (so there's no way it's proxying through the phone).

  • over 3 years ago

    You can see on the Fr645m only AMZ root cert used by Heroku works. Comodo, multiple Digicert and Let's Encrypt don't work.

    On Fenix 5plus, nothing works.

    On Venu 2s everything works

    On Fenix6pro everything works.

  • over 3 years ago

    The fact that none of the certs I've tried so far are working, could also point to some other underlying issue in the connection, but not sure what since the watch says that it's connecting.

    This points to another issue: the overloaded nature of UNKNOWN_ERROR. It would be nice if TLS cert validation issues were broken out into their own error code, e.g. Communications.SECURE_CONNECTION_FAILED or similar.