AcornSSL and Unverified Certificates

Two questions about AcornSSL and certificates, while using the latest v1.06 (27 May 2023) mbedTLS 2.28.9…

• The prompt for Unverified Certificate Chain has an option ‘Always Accept’ – but it does not seem to have any lasting effect. It is a self-signed certificate on my LAN printer – could this be the cause? If so, it is very annoying restriction. Anyone else seen this?

• The facility has obviously worked in the past, because there is a file in Choices.WWW.AcornSSL called CertAccept which was last saved many months ago, and contains 6 blocks of 32 characters 0-f. I would rather like to check what is in there, so I can delete any no longer applicable. Is there any way to find what website (or sites) that refers to?

Always Accept works for self-signed certs on my own LAN (in this case, a Hue lighting controller). There’s a file somewhere in Boot (I’m not at my RISC OS machine so don’t have the exact name/path handy) [Edit: I should read both bullet points before replying!] that gets added to when you click on Always Accept, and I wonder whether it might be flagged as read-only.

Another possibility is that your printer is actually issuing a different certificate each time you connect, although that seems unlikely because it would presumably also cause problems with other operating systems.

@Chris: Thanks – interesting that a self-signed cert works on your LAN. Perhaps that is not my problem.
CertExcept is not read-only … but it has not been updated since 26th May 2024, so it is not being updated with the printer cert reference.

It is a self-signed certificate on my LAN printer

From a PC, run NMAP to scan the printer to see the details of the certificate and the ciphers

nmap -p 22,443 --script ssl-cert 192.168.0.1 (or whatever) for the certificate, particularly the validity dates.

nmap -p 443 -Pn --script ssl-enum-ciphers 192.168.0.1 for the ciphers, although that’s probably not applicable in your instance if it’s merely just protesting the certificate validity