search

mreinstein / alexa-verifier

✓ Verify HTTP requests sent to an Alexa skill are sent from Amazon
MIT License
76 stars 23 forks source link

Update to Alexa Certificate #58

Closed owise1 closed 6 years ago

owise1 commented 6 years ago

Hi,

Sorry if this is an ignorant question. I received a notification from Amazon regarding an update to their certificate. Will this module continue to work after the switch? Or is there something else I need to do one my end.

We are replacing the certificate that Alexa uses to sign https requests on June 28, 2018. To ensure that your skill will continue to operate uninterrupted, please verify that:

  • Your endpoint certificate checks are not pinned in code.
  • Your endpoint accepts of the Amazons Trust Services Certificate Authority (CA).
  • You are following the guidelines outlined in our technical documentation.
mreinstein commented 6 years ago

thanks @owise1 ! Do you have more details on this? I'd be happy to take a look. Maybe the code is pointing at what will soon be an outdated cert.

owise1 commented 6 years ago

Here's the entire email:

Verify Proper Certificate Validation in Your Alexa HTTPS Skill Endpoint   You are receiving this message because you have published an Alexa skill that uses an https endpoint. We are replacing the certificate that Alexa uses to sign https requests on June 28, 2018. To ensure that your skill will continue to operate uninterrupted, please verify that: 

  • Your endpoint certificate checks are not pinned in code.
  • Your endpoint accepts of the Amazons Trust Services Certificate Authority (CA).
  • You are following the guidelines outlined in our technical documentation.Please ensure that your endpoint follows the instructions above by June 28, 2018. If it does not, customer interactions with your skill will fail.
mreinstein commented 6 years ago

As far as I can tell this Amazon change should not affect the operation of this module. If you run into any problems though, please do let me know. Thanks for the heads-up!