SSL and IOT devices - Never hardcode intermediate certificates and more

[Osiris]

@Suorong

Do you mean that ssl clients should be able to download new intermediates ?

ACME clients should use the intermediate certificate provided by the ACME server when getting a certificate.

That said, the certificates actually do contain the issuer certificate embedded in it, but not every SSL client uses that information to download the extra certs required.

@Suorong

Also, for example, say ISRG X1 is revoked tomorrow, how would IOT devices have to handle that ?

By having a backup CA. Never ever have a single point of failure for such critical devices (probably without easy upgrade capabilities).

@Suorong

For the intermediate R4 is already there to handle a potential R3 revocation, does that mean that the firmware should always include R3 and R4 ?

No, the firmware should not pin intermediate certificates as if it were root certificates. We're talking about intermediate certificates served by the webserver here, not which certificate is trusted.