OptiStick X5M: CA store fix (Debian #1151413)
| Issue | SEI reported that two root CAs whose private keys leaked are still trusted by our image: emSign ECC Root CA - G3 and Comodo AAA Services root (Debian #1151413). There is no CVE ID. |
|---|---|
| Fix | ca-certificates 20211016 (poky) → Debian 20260816+nmu1, panthor lane only (:k6.12). Every other lane stays on 20211016. |
| Image tested | dbg1548, commit df4ae8785, BUILD_ID 20261110T113004Z-1202928105, on the fused test Stick (prod-signed bootloader) |
Verdict: no issues found. Every HTTPS path we tested still verifies. The two leaked roots and 47 legacy roots are no longer trusted.
What changes in the trust store
| Before | 127 roots |
|---|---|
| After | 120 roots: 49 removed, 42 added, 5 reissued under the same name (GTS R1/R3/R4, GlobalSign ECC R4, Firmaprofesional) |
| Removed | The 2 leaked roots, plus 47 legacy roots Mozilla dropped in 2021–2026, such as DigiCert Global Root CA, Baltimore, GlobalSign R1 and R2, Go Daddy and Starfield Class 2, the Entrust family, QuoVadis 2 and 3, TrustCor and Trustwave |
| Added | Newer roots, such as DigiCert G5, Sectigo R46 and E46, ISRG X2, HARICA, Telia v3 and SECOM 2024 |
| Who is affected | Anything that verifies HTTPS through the system store: OTA, app update, telemetry, SecureLink, pairing, log and screenshot upload, YouTube download, streams played by mpv, 802.1x, and user-installed CAs. The player's web content uses Chromium's own root store. |
| Rollback | All 49 removed roots are kept in docs/security/ca-certificates/ with their SHA-256 and the restore steps for one root. The 2 leaked roots must never be restored. |
Test results
| Area | What was checked | Result |
|---|---|---|
| Source | The recipe's SRCREV is the commit of the official Debian tag debian/20260816+nmu1 | match |
| Endpoints (host) | New bundle against 23 of our endpoints (backend, OTA, telemetry, CDN, DO Spaces, Google, YouTube, S3) and 49 common content sites (Microsoft and Power BI, Google Docs, Dropbox, Box, Vimeo, Twitch, social media, weather, news, Canva, Tableau, Slack, Zoom, Apple, Akamai and more) | all verify |
| Trust store (device) | 37 checks: exactly the 120 expected roots by SHA-256, none of the 49 removed ones, the store is rebuilt the same after an update, a user-installed CA is kept and removed correctly, 20 endpoints verify with the device's own openssl and curl, and no certificate errors in the logs | 37/37 pass |
| Business cases (harness) | 24 HTTPS-related cases, 33 variants: pairing, unpair and zero-touch pairing, time sync, split screen, website, Power BI, YouTube (web and native, updater check), HLS stream, refresh, screenshot upload, log upload, WebSocket, remote VNC, OTA check, cert install, network outage recovery | 25 pass, 6 skipped (bench gear), 1 test issue (CP-YTN-003, below) |
| Content playback (harness) | 44 cases run before the scope was narrowed: playlists, images, PDF, designer, dashboards, schedules | 43 pass, 1 playback timing issue (CP-PL-013, below) |
| 802.1x | No bench gear, so a wired 802.1x link was built on the Stick: our own hostapd on a virtual link, the bench RADIUS server, and the image's NetworkManager and wpa_supplicant | 4/4 as expected |
802.1x
| Case | Expected | Result |
|---|---|---|
| PEAP, trusting the bench CA | login | pass |
| EAP-TLS with a client certificate | login | pass |
| PEAP, trusting only the system store (the server cert is not from a public CA) | rejected | rejected |
| PEAP, wrong password | rejected | rejected |
Two failures, both unrelated to certificates
| Case | Why |
|---|---|
| CP-YTN-003 (YouTube kill-switch) | The case blocks the control plane and turns the switch on locally. The player still reached the control plane over HTTPS and re-synced the switch off, so the block was incomplete. TLS itself worked. |
| CP-PL-013 (split-screen playlist member) | The frame sample caught a video zone in the middle of a transition. This is playback timing, with no network involved. |
Not covered
| Item | Reason |
|---|---|
| Wi-Fi 802.1x through a real enterprise AP | There is no enterprise AP on the temporary bench. The wired test covers the same supplicant and certificate path. |
| DEV-CTL-020 (install a player version through MDM) | The rig does not declare the app_update gear |
| DEV-LC-009, DEV-LC-023 (player self-update) | The test framework marks them not applicable to the Stick |
| 6 skipped variants | No USB drive, Wi-Fi is the only uplink (the security lock would cut the bench off), no Bluetooth remote, no wg0.conf on the bench for the SecureLink churn test |
| Multi-screen sync | No second unit |