fix webOS ca certificates for DST Root X3 expiry (on rooted TVs)

0webosbrew-letsencrypt-ca.md

HowTo

• Root via rootmy.tv
• Install

Tested on webOS 4.5, should at least on webOS 3.5+

Installation/Update

curl -qs "https://gist.githubusercontent.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9/raw/install.sh?$(date +%s)" | sh -

Removal

/var/lib/webosbrew/init.d/letsencrypt-ca-certs clean
rm /var/lib/webosbrew/init.d/letsencrypt-ca-certs

License

BSD0

install.sh

#!/bin/sh
set -e

if [ "$(id -u)" != 0 ]; then
  echo "ERROR: Must run as root"
  exit 1
fi

URL="https://gist.githubusercontent.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9/raw/letsencrypt-ca-certs.sh?$(date +%s)"
INITD="/var/lib/webosbrew/init.d"
START_DEVMODE="/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/start-devmode.sh"

echo "Installing letsencrypt-ca-certs"
mkdir -p "$INITD"
curl -qs "$URL" -o "$INITD/letsencrypt-ca-certs"
chmod +x "$INITD/letsencrypt-ca-certs"

# For comparibility with 3 versions of RootMyTV:
# Starting from RootMyTV2 startup.sh is used and has ran-parts
# Older versions of RootMyTV have ran-parts in start-devmode
# Popular russian fork of old RootMyTV doesnt have run-parts at apl
if [ ! -f "/var/lib/webosbrew/startup.sh" ] && ! grep -qs "run-parts $INITD" "$START_DEVMODE"; then
  echo "Notice: Incompatible/outdated start-devmode.sh detected"
  echo "Notice: run-parts was added to start-devmode for comaptibility"
  echo "Notice: please update your root/start-devmode script"

  cat <<EOF >>"$START_DEVMODE"

# Added by letsencrypt-ca-certs installer for compat
# !!! UPDATE YOUR ROOT SCRIPTS PLEASE !!!
if [[ -d "$INITD" ]]; then
  run-parts "$INITD"
fi

EOF
fi

"$INITD/letsencrypt-ca-certs" clean
"$INITD/letsencrypt-ca-certs"

letsencrypt-ca-certs.sh

#!/bin/sh
# source: https://gist.github.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9
set -e

PERSIST="/media/letsencrypt-ca-certs"
REPLACE_CERT="mozilla/DST_Root_CA_X3.crt"

CERTS="/usr/share/ca-certificates"
ETCCERTS="/etc/ssl/certs"

if [ "$1" = "clean" ]; then
  if grep -qs " $ETCCERTS " /proc/mounts; then
    umount "$ETCCERTS"
  fi
  if grep -qs " $CERTS/$REPLACE_CERT " /proc/mounts; then
    umount "$CERTS/$REPLACE_CERT"
  fi
  if [ -d "$PERSIST" ]; then
    rm -r "$PERSIST"
  fi
  exit 0
fi

if [ ! -d "$PERSIST" ]; then
  mkdir -p "$PERSIST"
fi

if [ ! -f "$PERSIST/ISRG_Root_X1.crt" ]; then
  # from https://letsencrypt.org/certs/isrgrootx1.pem
  cat <<EOF >"$PERSIST/ISRG_Root_X1.crt"
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
EOF
fi

if ! grep -qs " $CERTS/$REPLACE_CERT " /proc/mounts; then
  echo "Replacing $REPLACE_CERT with ISRG_Root_X1"
  mount --bind "$PERSIST/ISRG_Root_X1.crt" "$CERTS/$REPLACE_CERT"
fi

skip_etc_certs=0
if [ -f "$PERSTST/skip_etc_certs" ]; then
  echo "skip_etc_certs present, skipping $ETCCERTS remount"
  skip_etc_certs=1
else
  if [ ! -f "$PERSIST/certs/ca-certificates.crt" ]; then
    echo "generating new ca certs"
    mkdir -p "$PERSIST/certs"

    if ! update-ca-certificates --verbose --fresh --etccertsdir "$PERSIST/certs" \
      || [ ! -f "$PERSIST/certs/ca-certificates.crt" ]; then
      echo "update-ca-certificates failed, enabling skip_etc_certs"
      skip_etc_certs=1
      touch "$PERSIST/skip_etc_certs"
      rm -r "$PERSIST/certs" || :
    fi
  fi
fi

if [ "$skip_etc_certs" = "0" ]; then
  if ! grep -qs " $ETCCERTS " /proc/mounts; then
    echo "Remounting $ETCCERTS"
    mount --bind "$PERSIST/certs" "$ETCCERTS"
  fi
fi

root@LGwebOSTV:~/certs# curl -k -O "https://gist.githubusercontent.com/stek29/761232c6f7e1ffbc36b98da2a3a0f4d9/raw/insta
ll.sh?$(date +%s)"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1289  100  1289    0     0   3331      0 --:--:-- --:--:-- --:--:--  3356
root@LGwebOSTV:~/certs# ls
install.sh?1735835203
root@LGwebOSTV:~/certs# sh install.sh?1735835203
Installing letsencrypt-ca-certs
root@LGwebOSTV:~/certs#

But it doesnt seem to do anything after that, and certs seem to still be expired, any idea why?

@Golaco

Check if /var/lib/webosbrew/init.d/letsencrypt-ca-certs is present.
Try running it with “clean” first, and without any args after that.
It should print more than just “Installing letsencrypt-ca-certs”.

Figured out a bit more, because the install used curl, and curl is not working without the "-k" because of invalid certs, it was not going past that curl command, changed just the line 15 from -qs to -k and got this:

root@LGwebOSTV:~/certs# sh install.sh 
Installing letsencrypt-ca-certs
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3586  100  3586    0     0   9575      0 --:--:-- --:--:-- --:--:--  9639
Replacing mozilla/DST_Root_CA_X3.crt with ISRG_Root_X1
generating new ca certs
/usr/sbin/update-ca-certificates: [--verbose] [--fresh]
update-ca-certificates failed, enabling skip_etc_certs