Child Item

Change of Certification

Hi,

We are using Dropbox API to download firmware updates to our devices. I understand that there has been a recent change with the certification of your servers. This change causes our update process to fail as we are not using a different certificate.

We have been using DigiCert High Assurance EV Root CA to connect api.dropboxapi.com (162.125.69.19) and https://content.dropboxapi.com/ (162.125.69.14) which has been working just fine. Now we get an error "Used wrong CA to verify the peer." It seems like the certificate on the file server has been changed to DigiCert Global Root CA.

This means that we can not update our devices anymore. Can this change be reverted or at least can both certificates be accepted for connection to file server?

Best,

Find more posts tagged with

API

Abuse

Accepted answers

Greg-DB

We've switched content.dropboxapi.com back to using DigiCert High Assurance EV Root CA. Please let us know if you're still seeing any issues.

@4mooreben Yes, that's correct, this switch should not be considered permanent. We recommend updating the trust store, to trust both roots if possible. I'll ask the team for some longer term guidance as to a timeline.

All comments

Greg-DB

Thanks for writing this up. The content.dropboxapi.com servers are now being served with a certificate using DigiCert Global Root CA. I'll ask the team to see if we can switch that back to DigiCert High Assurance EV Root CA (or support both), but I can't guarantee if/when that would be done. I'll follow up here with any updates on that.

Either way, we recommend updating your trust store to include DigiCert Global Root CA if possible.

4mooreben

Hi Greg,

This issue is impacting many embedded client devices which do not maintain a complete certificate trust store and use Dropbox for distributing firmware updates. Instead of a complete certificate trust store, the client devices must be loaded with select certificates that are needed for verifying certificate chains when establishing secure connections to a server.

Since Dropbox is the only server that is being used for distributing updates in some cases, these devices can't be updated to use the new root CA without first switching the servers back to the old root CA.

We need to start a discussion with Dropbox on how we can resolve this issue for our mutual customers. I think this would be best handled off the forum. Please see my email below to contact me directly.

Best Regards,

Ben M

Greg-DB

@4mooreben Thanks for the additional information! This has been raised with team internally. I'll follow up here once I have any news on this from them.

I've redacted your email address for the sake of privacy, but for reference, you can always open an API ticket privately here if you need.

4mooreben

Perfect. Thank you!

-Ben M

Greg-DB

We are working on switching this back now. I'll follow up here once that's done.

4mooreben

Thanks, Greg. I'll continue to monitor for updates.

I assume this wouldn't be a permanent change on your side. I think it would be good to review the timeline around how long you can keep it switched back for. We will start communicating to our customers asap to make sure they are aware.

Best,

Ben M

Greg-DB

We've switched content.dropboxapi.com back to using DigiCert High Assurance EV Root CA. Please let us know if you're still seeing any issues.

tim-dev

Thank you very much for your fast response. The update procedure works now. It is important for us to know how long this change will be effective, in order to communicate with our customers for a firmware update. Please let us know as soon as you hear back from the team.

charlesfish

I also am interested in how long this change will persist for. We have some boards that use OTA that we plan on using for testing during the next few weeks. They are supposed to go out Monday, but if we have to deal with changing certificates during the next month or two, we will have to push back our release to implement a method to handle that.

Thanks in advance,

Charles

Greg-DB

I've confirmed with the team that this switch back to DigiCert High Assurance EV Root CA is not permanent. As our current certificates expire, we will be moving away from using EV certificates. Please update your trust store as mentioned, and do so by August. (The current certificate using DigiCert High Assurance EV Root CA for api.dropboxapi.com expires this coming September, so we'll be updating it by then.)

charlesfish

Is there a way for us to know when the certificates are about to switch? Like some sort of e-mail notifiaction or something we could sign up for that will warn us when this is going to happen, so we know to update to the new certificates in advance?

Thanks!!

Charles Fleck

4mooreben

Thank you for the update. We will work on getting the word out to our customers to prepare them for the change.

Greg-DB

@charlesfish We don't currently have anything like that, but I'll bring this up with the team to see if we can formalize some sort of system/notification for this. I can't promise if or when that might be implemented though. Thanks for the note!

Greg-DB

In order to provide more time for clients to update their trust stores, we will continue the use of DigiCert High Assurance EV Root CA until at least January 1st, 2022. We will soon replace the current certificate for api.dropboxapi.com, which expires soon, with another one also from DigiCert High Assurance EV Root CA. However starting starting January 1st, 2022, we may switch our CA at any time, so make sure to update your trust store to trust both DigiCert High Assurance EV Root CA and DigiCert Global Root CA by then.

BartVD

Dear Greg,

I believe a customer of ours is confronted with the described issue as well.

The concerned device only has the DigiCert High Assurance EV Root CA certificate to connect to ‘api.dropboxapi.com’ (162.125.65.19) for its OTA-updates.

The product is using an older version of the SimpleLink-cc32xx-sdk from TI (< v5.10). This version is not handling the update Dropbox rolled out in August 2021.

If different certificates are used for the Dropbox OTA (CDN) server and the Dropbox fileserver itself, the one that’s needing the ‘DigiCert Global Root CA’ will not work.

Apparently, this is only noticed very late. The update process isn’t triggered regularly or monitored that closely. A warning message from dropbox was not received or was overlooked.

The dropbox method is the only way to get the devices updated over the air. The number of devices is significant.

What options do we have to get all these devices updated?

Feel free to contact me at temporary.mail4dropbox@gmail.com

Thanks in advance,
Bart

Greg-DB

@BartVD Thanks for your message. As you found, Dropbox changed the certificate for api.dropboxapi.com from DigiCert High Assurance EV Root CA and it is currently being served with a valid certificate using DigiCert Global Root CA. (You can find the details on the transition in my previous messages from 2021 in this thread.) So, any remaining devices without a more complete trust store, or without at least the two necessary for that transition, would have no longer been compatible once that was done.

Unfortunately this isn't user-configurable; in order to connect to api.dropboxapi.com now, clients would need to trust DigiCert Global Root CA to validate the certificate to establish the secure connection. I'm afraid I don't have any other options to offer if the client does not do so.