Who is affected

Only the outgoing connections an app makes over HTTPS, for example REST or web service calls, or other integrations with external systems are affected. Traffic coming in to an app, such as users opening it in a browser, is not affected.

What Mendix has done

Mendix updated the Mendix Cloud build process so that apps built from 22 Oct on no longer trust the compromised certificates. Mendix has also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. On 23 Oct, Mendix will do another update to get the latest Java/JRE releases included.

Actions Required To Apply Fix

The fix is added when the app is built, so apps that are already running only pick it up on a redeploy. A restart is not enough.

If an app makes outgoing calls to other systems, please redeploy it. Do this in the usual order for releasing changes (Test, Acceptance, then Production) and check that integrations still work before redeploying Production.

If an app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

A redeploy causes a short downtime while the app restarts, so plan it in a convenient window.

What to expect after redeploying

If one of the systems an app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. 

In that case, ask the owner of that system to replace its certificate