Update ECU definition from internet seems to be broken at least on Windows

[AndreyB]

TS no longer downloads fresh .ini files automatically for me, can someone who uses Windows confirm or deny having same issue?

I believe this is about TS having too old version of JRE 1.8.0_66 from back 2015 emended. I've actually replaced cacerts file with a file from a fresh 1.8 JRE instance and got the issue resolved.

https://github.com/rusefi/rusefi/issues/5536

[AndreyB]

PS: corresponding log line in TunerStudioAppDebug.txt is

Code: Select all

Debug: Failed to get ini: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[AndreyB]

Oh right, it's the annual rusefi.com certificate update and 25% of the 1.8.0_66 CA certificates have already expired.

image.png (16.34 KiB) Viewed 36055 times

[NormanAlphaspeed]

Untitled.jpeg (199.53 KiB) Viewed 36013 times

Untitled.jpeg (231.83 KiB) Viewed 36013 times

large amount of end users in panic because choosing ini file is too difficult

[NormanAlphaspeed]

More reports of angry people

image.png (2.95 MiB) Viewed 35897 times

[AndreyB]

Work-around is now documented at https://github.com/rusefi/rusefi/wiki/JRE#tunerstudio-cacerts-work-around

[mck1117]

Work-around is now documented at https://github.com/rusefi/rusefi/wiki/JRE#tunerstudio-cacerts-work-around

Are you recommending that users install a custom certificate authority globally for all Java apps? That's TERRIBLE security advice. You know better than that.

[AndreyB]

globally for all Java apps?

Please see where you are wrong.

On my end let me spell out source of cacerts file

[mck1117]

So it is just for TS, but it's still a risk. TS is using that file for downloading updates to TS, which then run as administrator on your PC. So you've now installed a CA (if only to TS) that can serve files that are expected to grant admin rights.

[mck1117]

Can you explain the actual issue that requires adding a CA?

[AndreyB]

https://github.com/rusefi/rusefi/wiki/JRE#tunerstudio-cacerts-work-around clarifies source of cacerts file, thank you for your feedback.

Matt please read github ticket in first post and let me know if I can clarify anything beyond what is already documented.

[AndreyB]

rusEFI bundles now contain 'update-ts-cacerts' folder with fixts.bat

[NormanAlphaspeed]

rusEFI bundles now contain 'update-ts-cacerts' folder with fixts.bat

~credit to norman for writing a crappy batch file