When does one load new ca-certs onto client?

[Feynman137]

@petercooperjr

RED ALERT! That's completely wrong!

That chain.pem is for your server . It has nothing to do with setting up a trust store for your client .

The client is using it for server authentication. According to this post Loading SSL keys onto client, which ones? - Help - Let's Encrypt Community Support (letsencrypt.org)

I apologize if this wasn't made clear earlier. Is this not correct?

@jsha

I recommend making your own CA to issue certificates for the server. You can generate one very easily with GitHub - jsha/minica: minica is a small, simple CA intended for use in situations where the CA operator also operates each host where a certificate will be used.. You load the resulting minica.pem (the root certificate aka root certificate) onto the devices, and keep a copy for yourself to generate future certificates.

Thank you very much I will read through this as this is something I need to address. To your earlier point I haven't a clue how I will update these while they are in the field. The only thing in my favor here is that the device isn't doing a whole lot. So firmware is pretty simple.