fix webOS ca certificates for DST Root X3 expiry (on rooted TVs)

0webosbrew-letsencrypt-ca.md

HowTo

• Root via rootmy.tv
• Install

Tested on webOS 4.5, should at least on webOS 3.5+

Installation/Update

curl -qs "https://gist.githubusercontent.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9/raw/install.sh?$(date +%s)" | sh -

Removal

/var/lib/webosbrew/init.d/letsencrypt-ca-certs clean
rm /var/lib/webosbrew/init.d/letsencrypt-ca-certs

License

BSD0

install.sh

#!/bin/sh
set -e

if [ "$(id -u)" != 0 ]; then
  echo "ERROR: Must run as root"
  exit 1
fi

URL="https://gist.githubusercontent.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9/raw/letsencrypt-ca-certs.sh?$(date +%s)"
INITD="/var/lib/webosbrew/init.d"
START_DEVMODE="/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh"

echo "Installing letsencrypt-ca-certs"
mkdir -p "$INITD"
curl -qs "$URL" -o "$INITD/letsencrypt-ca-certs"
chmod +x "$INITD/letsencrypt-ca-certs"

# For comparibility with 3 versions of RootMyTV:
# Starting from RootMyTV2 startup.sh is used and has ran-parts
# Older versions of RootMyTV have ran-parts in start-devmode
# Popular russian fork of old RootMyTV doesnt have run-parts at apl
if [ ! -f "/var/lib/webosbrew/startup.sh" ] && ! grep -qs "run-parts $INITD" "$START_DEVMODE"; then
  echo "Notice: Incompatible/outdated start-devmode.sh detected"
  echo "Notice: run-parts was added to start-devmode for comaptibility"
  echo "Notice: please update your root/start-devmode script"

  cat <<EOF >>"$START_DEVMODE"

# Added by letsencrypt-ca-certs installer for compat
# !!! UPDATE YOUR ROOT SCRIPTS PLEASE !!!
if [[ -d "$INITD" ]]; then
  run-parts "$INITD"
fi

EOF
fi

"$INITD/letsencrypt-ca-certs" clean
"$INITD/letsencrypt-ca-certs"

letsencrypt-ca-certs.sh

#!/bin/sh
# source: https://gist.github.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9
set -e

PERSIST="/media/letsencrypt-ca-certs"
REPLACE_CERT="mozilla/DST_Root_CA_X3.crt"

CERTS="/usr/share/ca-certificates"
ETCCERTS="/etc/ssl/certs"

if [ "$1" = "clean" ]; then
  if grep -qs " $ETCCERTS " /proc/mounts; then
    umount "$ETCCERTS"
  fi
  if grep -qs " $CERTS/$REPLACE_CERT " /proc/mounts; then
    umount "$CERTS/$REPLACE_CERT"
  fi
  if [ -d "$PERSIST" ]; then
    rm -r "$PERSIST"
  fi
  exit 0
fi

if [ ! -d "$PERSIST" ]; then
  mkdir -p "$PERSIST"
fi

if [ ! -f "$PERSIST/ISRG_Root_X1.crt" ]; then
  # from https://letsencrypt.org/certs/isrgrootx1.pem
  cat <<EOF >"$PERSIST/ISRG_Root_X1.crt"
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
EOF
fi

if ! grep -qs " $CERTS/$REPLACE_CERT " /proc/mounts; then
  echo "Replacing $REPLACE_CERT with ISRG_Root_X1"
  mount --bind "$PERSIST/ISRG_Root_X1.crt" "$CERTS/$REPLACE_CERT"
fi

skip_etc_certs=0
if [ -f "$PERSTST/skip_etc_certs" ]; then
  echo "skip_etc_certs present, skipping $ETCCERTS remount"
  skip_etc_certs=1
else
  if [ ! -f "$PERSIST/certs/ca-certificates.crt" ]; then
    echo "generating new ca certs"
    mkdir -p "$PERSIST/certs"

    if ! update-ca-certificates --verbose --fresh --etccertsdir "$PERSIST/certs" \
      || [ ! -f "$PERSIST/certs/ca-certificates.crt" ]; then
      echo "update-ca-certificates failed, enabling skip_etc_certs"
      skip_etc_certs=1
      touch "$PERSIST/skip_etc_certs"
      rm -r "$PERSIST/certs" || :
    fi
  fi
fi

if [ "$skip_etc_certs" = "0" ]; then
  if ! grep -qs " $ETCCERTS " /proc/mounts; then
    echo "Remounting $ETCCERTS"
    mount --bind "$PERSIST/certs" "$ETCCERTS"
  fi
fi

https://webostv.developer.lge.com/develop/specifications/tls

Updated webOS 3.x and 4.x should have the certs working fine.
5.x should just be working.

This is according to the above statement by LG.
From my experience, updating does not jack, all the way to 05.50.15 (.10->.15, root survived) and I still get issuer errors.
This script does not seem to work either, unfortunately.

See webosbrew/webos-homebrew-channel#179

@C0rn3j official LG Developer email has replied to me saying they won't fix this on older devices. I'm not sure if anything has changed since.

Date: Tue, 5 Oct 2021 06:51:15 +0300
Subject: webOS TV: Let's Encrypt DST Root CA X3 Expiration issues
From: Viktor Oreshkin <[email protected]>
To: [email protected]

Hello,
It seems that due to Let's Encrypt DST Root CA X3 Expiration and lack of
ISRG Root certificates in trusted CA list there's no way to access sites
using Let's Encrypt issued certificates in the web app, no matter how
remote web server is configured.

The issue affects at least TVs with webOS TV 4.x and older, I'm not sure
about newer models.
Oh, and we browser app works fine, I guess that's because it uses different
version or different trusted CA lists.

Could you please issue an update with new CA lists and fixing Let's Encrypt
in Web Engine for older TV models?

Thanks in advance,
Viktor Oreshkin.

---

Date: Tue, 5 Oct 2021 13:34:02 +0900
Subject: RE: webOS TV: Let's Encrypt DST Root CA X3 Expiration issues
From: DeveloperLG <[email protected]>
To: Viktor Oreshkin <[email protected]>

Hello,

Thank you for contacting us.

ISRG Root X1 of Let's Encrypt is supported since the webOS TV 5.0 and later only, and we don't have any update plans for it now.

If you want to support previous versions of the webOS TV, please use a supported certificate for them.
You can find trusted root certificates for each webOS TV in Web Engine.

Best regards,
LG Developer Site Team