# Trouble after SSL Certificate rotation **URL:** \ **Category:** Help\ **Tags:** devices\ **Created:** [July 14, 2021, 1:59pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919 "2021-07-14T13:59:13Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\ **Post date:** [July 14, 2021, 1:59pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/1 "2021-07-14T13:59:13Z")
After the rotation yesterday, we have not had much luck connecting our devices. Access keys and secret should still work, right? ---
**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\ **Post date:** [July 14, 2021, 2:06pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/3 "2021-07-14T14:06:43Z")
@Lars_Andersson, Yes, Access Keys and Secrets should still work. Are you getting any error messages? Would you be able to share with me what error you are getting? The more information you can provide would be very beneficial. Thank you, Heath ---
**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\ **Post date:** [July 14, 2021, 2:20pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/4 "2021-07-14T14:20:11Z")
we are trying to get some debug data from the devices as we speak. Is there anywhere in Losant we could see if any devices have trouble to authenticate against the MQTTbroker? ---
**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\ **Post date:** [July 14, 2021, 2:30pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/5 "2021-07-14T14:30:48Z")
@Lars_Andersson, Failed authentication attempts will be available in the [Application Log](https://docs.losant.com/applications/overview/#application-log). Thank you, Heath ---
**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\ **Post date:** [July 14, 2021, 2:37pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/6 "2021-07-14T14:37:21Z")
I’m not aware of these being rotated before. Does this happen annually ? ---
**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\ **Post date:** [July 14, 2021, 2:40pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/7 "2021-07-14T14:40:25Z")
It looks like the error message we’re getting is that it’s failing to verify the “peer certificate” and that “certificate is not correctly signed by the CA.” ---
**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\ **Post date:** [July 14, 2021, 3:13pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/8 "2021-07-14T15:13:59Z")
Nothing related to the failing devices show up in the application log. Something not working as before on your side? ---
**Author:** ![Heath](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/heath/32/3036_2.png) [@Heath](https://forums.losant.com/u/Heath)\ **Post date:** [July 14, 2021, 3:25pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/9 "2021-07-14T15:25:34Z")
@Lars_Andersson, > I’m not aware of these being rotated before. Does this happen annually ? The last time we rotated SSL certificates was approximately 2 years ago. Now, SSL policy does not allow for multi-year certificates. So, our next SSL certificate rotation will be in approximately 1 year. > Nothing related to the failing devices show up in the application log. > Something not working as before on your side? Everything on our side is working as intended and is operational. No devices showing up in your Application Log indicate that your devices are not establishing a connection. Would you be able to tell me what type of devices you are experiencing this on (i.e. make and model)? How are these devices connecting to Losant? Thank you, Heath ---
**Author:** ![Zach\_Jacobs1](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/zach_jacobs1/32/2067_2.png) [@Zach\_Jacobs1](https://forums.losant.com/u/Zach_Jacobs1)\ **Post date:** [July 14, 2021, 3:56pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/10 "2021-07-14T15:56:43Z")
Heath, This rotation caused our entire fleet of devices to go offline and not come back. We aren’t able to push a firmware update as we use an MQTT workflow to deliver firmware URL for the update process. Is it possible for there to be a temporary rollback for us to update our SSL certificates? ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [July 14, 2021, 4:03pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/11 "2021-07-14T16:03:06Z")
Hey @Zach_Jacobs1 The underlying certificate authority (CA), which is what should be on your devices to validate the certificate, has not been changed. Outside of the CA, we’re not sure what would be on your device that would require an update. Can you please provide additional details about your environment, or any additional details into why your devices are unable to reconnect? ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [July 14, 2021, 4:11pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/12 "2021-07-14T16:11:59Z")
Hey @Lars_Andersson, Can you please copy/paste (or screenshot) the exact error you’re seeing? I’d like to see the exact wording of the message. ---
**Author:** ![Lars\_Andersson](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lars\_Andersson](https://forums.losant.com/u/Lars_Andersson)\ **Post date:** [July 14, 2021, 4:21pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/13 "2021-07-14T16:21:15Z")
An announcement 15 minutes before it happens at 10 pm, is a bit tight. Or did we miss some other announcements? ---
**Author:** ![Zach\_Jacobs1](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/zach_jacobs1/32/2067_2.png) [@Zach\_Jacobs1](https://forums.losant.com/u/Zach_Jacobs1)\ **Post date:** [July 14, 2021, 4:26pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/14 "2021-07-14T16:26:31Z")
@Brandon_Cannaday I’m digging into this a bit more right now and will get some more info shortly. ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [July 14, 2021, 4:39pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/15 "2021-07-14T16:39:00Z")
The [Status Page](http://status.losant.com/) is the best place to monitor for upcoming scheduled maintenance. We’ll make sure to post those on the forums earlier for future updates. With this specific update, there aren’t really actions that can be taken beforehand. The certificate we updated is not something that is distributed or something that is placed on any device. The root CA, which is the [DigiCert Global Root CA](https://www.digicert.com/kb/digicert-root-certificates.htm), is the important file and what may potentially be on devices (if your device validates the certificate). That file is unchanged. If our root CA does change, that would have significant impacts, which will require a long heads up. We’ve been watching our analytics closely around connected devices and we’ve not seen any identifiable drop in connections. So we’re very interested in finding out what, specifically, you’re seeing. ---
**Author:** ![Zach\_Jacobs](https://avatars.discourse-cdn.com/v4/letter/z/13edae/32.png) [@Zach\_Jacobs](https://forums.losant.com/u/Zach_Jacobs)\ **Post date:** [July 14, 2021, 6:32pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/16 "2021-07-14T18:32:50Z")
Brandon, The error that I’m seeing is: The certificate is not correctly signed by the trusted CA. We do indeed have a certificate on our devices to validate the certificate against the server. What is your preferred method for obtaining that certificate? We are currently using: `openssl s_client -showcerts -connect broker.losant.com:8883 /dev/null|openssl x509 -outform PEM > losant-root-ca.pem` ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [July 14, 2021, 7:38pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/17 "2021-07-14T19:38:06Z")
Ah, I see. That command downloads the actual certificate, not the root CA. You were validating the certificate against itself, which is not a common practice or secure. This would not prevent a man-in-the-middle attack serving you a compromised certificate from somewhere between you and Losant’s servers. Certificates are validated by making sure they are signed by a trusted CA. The CA is obtained directly from the certificate authority - separately from the certificate itself. There’s not really a command to obtain a CA. They are [publicly available](https://www.digicert.com/kb/digicert-root-certificates.htm) since they are not particularly sensitive. We also provide the CA in some of our [MQTT libraries](https://github.com/Losant/losant-mqtt-ruby/blob/master/lib/losant_mqtt/RootCA.crt). What you’ll need to do is download the CA from one of the links above and place that on your devices. This will result in a more secure environment and protect you from future certificate updates (which will happen yearly). CA files are good for much longer - 10 or so years. ---
**Author:** ![Zach\_Jacobs](https://avatars.discourse-cdn.com/v4/letter/z/13edae/32.png) [@Zach\_Jacobs](https://forums.losant.com/u/Zach_Jacobs)\ **Post date:** [July 14, 2021, 8:42pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/18 "2021-07-14T20:42:02Z")
Great, thanks. I was able to use the certificate from the “MQTT libraries” link and authenticate that way. Unfortunately I’m unable to roll this change out to my fleet with an OTA update since our existing code uses the old cert that is now expired. Is there a workaround for us to temporarily use the old certificate so we can update our devices that are offline? ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [July 14, 2021, 9:14pm UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/19 "2021-07-14T21:14:14Z")
The only way to accomplish that would be for us to roll back the certificate. While not impossible, it would be a risk we would prefer to avoid. Some, particularly strict, systems may not accept an older certificate once they’ve seen a newer one. So while it may allow your devices to connect, it may also have unforeseen consequences for other customers. This is the same certificate used for the Losant API, which facilitates a large number of system-to-system integrations. ---
**Author:** ![Zach\_Jacobs](https://avatars.discourse-cdn.com/v4/letter/z/13edae/32.png) [@Zach\_Jacobs](https://forums.losant.com/u/Zach_Jacobs)\ **Post date:** [July 15, 2021, 3:05am UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/21 "2021-07-15T03:05:14Z")
@Brandon_Cannaday – Hello, Did the intermediate certificate also change? Earlier this week, the command mentioned in my previous post: `openssl s_client -showcerts -connect broker.losant.com:8883 /dev/null|openssl x509 -outform PEM > losant-root-ca.pem` gave me the intermediate certificate as shown here: ```auto -----BEGIN CERTIFICATE----- MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83 nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f /ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0 /RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6 Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1 oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl 5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA 8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC 2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0 j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz -----END CERTIFICATE----- ``` This certificate is still showing as valid until 2023: [Certificate Decoder - Decode certificates to view their contents](https://www.sslshopper.com/certificate-decoder.html) > **Certificate Information:** > > ##### **Common Name:** DigiCert SHA2 Secure Server CA > > ##### **Organization:** DigiCert Inc > > ##### **Country:** US > > ##### **Valid From:** March 8, 2013 > > ##### **Valid To:** March 8, 2023 > > ##### **Issuer:** DigiCert Global Root CA, DigiCert Inc [Write review of DigiCert](https://www.sslshopper.com/digicert-certificate-authority-reviews.html#writeReview) > > ##### **Serial Number:** 01fda3eb6eca75c888438b724bcfbc91 This is what we have previously used to authenticate with and would not have any reason to expect this would expire (or not be usable) before the 2023 date. When I currently run the SSL command mentioned, I do in fact now receive a client certificate which I am not even able to use to authenticate with the server. ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [July 15, 2021, 3:45am UTC](https://forums.losant.com/t/trouble-after-ssl-certificate-rotation/3919/22 "2021-07-15T03:45:57Z")
Yes, the intermediate certificates did change. Typically, there is no reason the download these as part of any validation process. As part of the TLS negotiation that’s performed on every connection, the entire certificate chain is sent to the client from the server. The only file that’s required, and the one that’s also not sent by the server, is the root CA.