I have a mix release application running in a container but it seems to have problems with cacerts. If I run: docker exec -it 1773f1bd7685 bin/myapp eval ':public_key.cacerts_get()' I get: ** (UndefinedFunctionError) function :public_key.cacerts_get/0 is undefined or private (public_key 1.12.…

OTP-24 doesn’t have the cacerts_get/0 in public_key: Erlang -- public_key

That version of OTP and elixir are you using?

Hmm, if you mean whether I use the same locally and on prod then no… On prod I downgraded OTP to 24 due to the TLSv1.3 horror story I encountered and described in other thread. Elixir is the same (1.16.2) though, although I guess that doesn’t matter much in the case at hand

[image] silverdr: On prod I downgraded OTP to 24 due to the TLSv1.3 horror story I encountered and described in other thread. So are you using releases or you build releases on a different host?

I build releases using this “builder” image: Image Layer Details -...

That explains. Is there some kind of equivalent in 24, maybe?

All the functionality related to CA checks and loading was introduced starting from OTP-25, you can always fetch them manually from the system. I’m not 100% sure with what downgrading of OTP helps, but if there are specific algorithms that have holes in them, you can always disable them by configur…

The downgrade was done this morning due to OTP bug introduced in 25 and passed over to 26 , which caused critical functionality (email) to suddenly stop working after applying security updates to mail server (sic!) [image] D4no0: All the functionality related to CA checks and loading was introdu…

[image] silverdr: I see - would you suggest any “proper” way of doing this? I’m not sure what are you looking for, wouldn’t it be easier to upgrade to OTP-26.2.5+ where this issue was patched?

It would but there are no builder images for 26.2.5+ available yet. While I could build my own, setting this up is not a five minutes job. And also I’d rather prefer a “fail-safe” (like working with 24, 25, 26) solution in case I’d have to quickly downgrade again. More specifically what I want to h…

[image] silverdr: And also I’d rather prefer a “fail-safe” (like working with 24, 25, 26) solution in case I’d have to quickly downgrade again. While I understand this, I am also not very positive that you change versions everyday. I just now noticed that docker builds from hex do not come wi…

Function :public_key.cacerts_get/0 is undefined or private

Questions & Help Questions

silverdr May 13, 2024, 6:08pm 23

Things are working now (again) with OTP 26