My employer is developing an OpenWRT device that's an HTTPS client.  Naturally, we install ca-certificates.  Which works great together with our HTTPS client code (libcurl).

However, thinking long-term, over the years certificate authorities come and go.  So it seems like our device should also periodically update its ca-certificates.

I'm curious how have others solved this issue.  Perhaps a cron job that periodically updates ca-certificates via opkg?

Or am I missing something, and updating ca-certificates isn't really necessary?

Thanks!

Nothing works forever, but I'd suggest to check curl pages (using cron), see https://curl.haxx.se/docs/caextract.html, there's direct link to cert file.

Thanks, I'll try updating just that file.  If that works, I suppose I don't even need ca-certificates installed.

It worked!  Thanks nozombian