From 20d54d386eef92051712582ef3d11e607c51e49d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Oct 2025 00:56:52 +0000 Subject: [PATCH 1/4] Initial plan From 20f9bf3d26bba8e136eaef5afef2145519bc8dfe Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Oct 2025 01:01:11 +0000 Subject: [PATCH 2/4] Update docs with non-expiring certificate information Co-authored-by: sgbaird <45469701+sgbaird@users.noreply.github.com> --- docs/courses/hello-world/1.1-running-the-demo.md | 4 +++- docs/courses/hello-world/mqtt-warning.md | 6 +++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/courses/hello-world/1.1-running-the-demo.md b/docs/courses/hello-world/1.1-running-the-demo.md index db7f33a..650102d 100644 --- a/docs/courses/hello-world/1.1-running-the-demo.md +++ b/docs/courses/hello-world/1.1-running-the-demo.md @@ -30,7 +30,9 @@ the self-driving-lab-demo Python package. ✅ Follow the [video tutorial](https://youtu.be/D54yfxRSY6s) below. Consider printing a hardcopy of the [Build Instructions manuscript](https://doi.org/10.1016/j.xpro.2023.102329) or opening it in a separate tab. ```{warning} -You must copy [the `hivemq-com-chain.der` file](https://raw.githubusercontent.com/sparks-baird/self-driving-lab-demo/main/src/public_mqtt_sdl_demo/hivemq-com-chain.der) to the Pico W for it to work with recent version of the `self-driving-lab-demo` package. If you swapped out the credentials with your own broker information (required for the assignment), you must [generate your own `hivemq-com-chain.der` file](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb) due to a recent change in HiveMQ's security procedures (as of 2024-07-03). +You must copy [the `hivemq-com-chain.der` file](https://raw.githubusercontent.com/sparks-baird/self-driving-lab-demo/main/src/public_mqtt_sdl_demo/hivemq-com-chain.der) to the Pico W for it to work with recent version of the `self-driving-lab-demo` package. + +**Good news:** A non-expiring certificate solution is now available! If you swapped out the credentials with your own broker information (required for the assignment), you can [generate a non-expiring `hivemq-com-chain.der` file](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb) using the intermediate certificate (ISRG Root X1). This certificate will work across different HiveMQ broker instances and won't expire like the previous server-specific certificates. ``` diff --git a/docs/courses/hello-world/mqtt-warning.md b/docs/courses/hello-world/mqtt-warning.md index e2c36c8..f3a4b89 100644 --- a/docs/courses/hello-world/mqtt-warning.md +++ b/docs/courses/hello-world/mqtt-warning.md @@ -1,3 +1,7 @@ ```{warning} -Recently, HiveMQ Cloud changed such that `hivemq-com-chain.der` (a Certificate Authority (CA) file) is not transferrable across different broker instances. The [latest `hivemq-com-chain.der` file](https://raw.githubusercontent.com/sparks-baird/self-driving-lab-demo/main/src/public_mqtt_sdl_demo/hivemq-com-chain.der) from [`self-driving-lab-demo`](https://github.com/sparks-baird/self-driving-lab-demo) will be hard-coded to the `self-driving-lab-demo` public test credentials (i.e., what is used in Module 1 - Running the Demo), so the *tutorials* should run without issue as long as you are using that file. However, the *assignment* requires you to have your own HiveMQ Cloud broker instance, so you will need to [generate a `hivemq-com-chain.der` file specific to your instance](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb) and upload it to your microcontroller in place of the default one. +Recently, HiveMQ Cloud changed such that `hivemq-com-chain.der` (a Certificate Authority (CA) file) is not transferrable across different broker instances. However, a **non-expiring certificate solution** is now available using the intermediate certificate (ISRG Root X1) instead of the server-specific certificate. + +For the *tutorials*, the [latest `hivemq-com-chain.der` file](https://raw.githubusercontent.com/sparks-baird/self-driving-lab-demo/main/src/public_mqtt_sdl_demo/hivemq-com-chain.der) from [`self-driving-lab-demo`](https://github.com/sparks-baird/self-driving-lab-demo) is hard-coded to the `self-driving-lab-demo` public test credentials (i.e., what is used in Module 1 - Running the Demo), so the tutorials should run without issue. + +For the *assignment*, which requires you to have your own HiveMQ Cloud broker instance, you can [generate a non-expiring `hivemq-com-chain.der` file](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb) using the intermediate certificate. This certificate will work across different HiveMQ broker instances and won't expire like the previous server-specific certificates. ``` From d40ee30bf74183b4b607dbc0f0a3802dbd86fe68 Mon Sep 17 00:00:00 2001 From: "Sterling G. Baird" Date: Mon, 17 Nov 2025 18:57:40 -0500 Subject: [PATCH 3/4] Revise certificate instructions for Pico W setup Updated instructions for using the `hivemq-com-chain.der` file and introduced the non-expiring root certificate option. --- docs/courses/hello-world/1.1-running-the-demo.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/courses/hello-world/1.1-running-the-demo.md b/docs/courses/hello-world/1.1-running-the-demo.md index 650102d..641c8be 100644 --- a/docs/courses/hello-world/1.1-running-the-demo.md +++ b/docs/courses/hello-world/1.1-running-the-demo.md @@ -30,9 +30,7 @@ the self-driving-lab-demo Python package. ✅ Follow the [video tutorial](https://youtu.be/D54yfxRSY6s) below. Consider printing a hardcopy of the [Build Instructions manuscript](https://doi.org/10.1016/j.xpro.2023.102329) or opening it in a separate tab. ```{warning} -You must copy [the `hivemq-com-chain.der` file](https://raw.githubusercontent.com/sparks-baird/self-driving-lab-demo/main/src/public_mqtt_sdl_demo/hivemq-com-chain.der) to the Pico W for it to work with recent version of the `self-driving-lab-demo` package. - -**Good news:** A non-expiring certificate solution is now available! If you swapped out the credentials with your own broker information (required for the assignment), you can [generate a non-expiring `hivemq-com-chain.der` file](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb) using the intermediate certificate (ISRG Root X1). This certificate will work across different HiveMQ broker instances and won't expire like the previous server-specific certificates. +You must copy [the `hivemq-com-chain.der` file](https://raw.githubusercontent.com/sparks-baird/self-driving-lab-demo/main/src/public_mqtt_sdl_demo/hivemq-com-chain.der) to the Pico W for it to work with recent version of the `self-driving-lab-demo` package. A non-expiring, "root" certificate is contained in `sdl_demo.zip` packages releases v0.8.13 and beyond [[colab](https://colab.research.google.com/gist/sgbaird/5ddef425e8d4aae454a69fbce8654faf/hivemq-root-cert.ipynb)]. You can also [generate a `hivemq-com-chain.der` certificate specific to your HiveMQ instance](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb). We recommend using the non-expiring, root certificate, which is applicable for all HiveMQ instances. ``` From 30a6e0841b60ea6d59592ab6bc46ea34287fbbe5 Mon Sep 17 00:00:00 2001 From: "Sterling G. Baird" Date: Mon, 17 Nov 2025 19:03:17 -0500 Subject: [PATCH 4/4] Revise MQTT warning for HiveMQ Cloud certificates Updated the warning about HiveMQ Cloud certificate changes and added information on non-expiring certificates. --- docs/courses/hello-world/mqtt-warning.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/docs/courses/hello-world/mqtt-warning.md b/docs/courses/hello-world/mqtt-warning.md index f3a4b89..e841bab 100644 --- a/docs/courses/hello-world/mqtt-warning.md +++ b/docs/courses/hello-world/mqtt-warning.md @@ -1,7 +1,5 @@ ```{warning} -Recently, HiveMQ Cloud changed such that `hivemq-com-chain.der` (a Certificate Authority (CA) file) is not transferrable across different broker instances. However, a **non-expiring certificate solution** is now available using the intermediate certificate (ISRG Root X1) instead of the server-specific certificate. +Recently, HiveMQ Cloud changed such that `hivemq-com-chain.der` (a Certificate Authority (CA) file) is not transferrable across different broker instances. However, a **non-expiring certificate solution** is available using the intermediate certificate (ISRG Root X1) instead of the server-specific certificate. -For the *tutorials*, the [latest `hivemq-com-chain.der` file](https://raw.githubusercontent.com/sparks-baird/self-driving-lab-demo/main/src/public_mqtt_sdl_demo/hivemq-com-chain.der) from [`self-driving-lab-demo`](https://github.com/sparks-baird/self-driving-lab-demo) is hard-coded to the `self-driving-lab-demo` public test credentials (i.e., what is used in Module 1 - Running the Demo), so the tutorials should run without issue. - -For the *assignment*, which requires you to have your own HiveMQ Cloud broker instance, you can [generate a non-expiring `hivemq-com-chain.der` file](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb) using the intermediate certificate. This certificate will work across different HiveMQ broker instances and won't expire like the previous server-specific certificates. +A non-expiring, "root" certificate is contained in `sdl_demo.zip` packages [releases](https://github.com/sparks-baird/self-driving-lab-demo/releases) v0.8.13 and beyond [[colab](https://colab.research.google.com/gist/sgbaird/5ddef425e8d4aae454a69fbce8654faf/hivemq-root-cert.ipynb)]. You can also [generate a `hivemq-com-chain.der` certificate specific to your HiveMQ instance](https://colab.research.google.com/github/sparks-baird/self-driving-lab-demo/blob/main/notebooks/7.2.1-hivemq-openssl-certificate.ipynb). We recommend using the non-expiring, root certificate, which is applicable for all HiveMQ instances. ```