Who is affected

Only the outgoing connections an app makes over HTTPS, for example REST or web service calls, or other integrations with external systems are affected. Traffic coming in to an app, such as users opening it in a browser, is not affected.

What Mendix has done

Mendix updated the Mendix Cloud build process so that apps built from 22 Oct on no longer trust the compromised certificates. Mendix has also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. 

Actions Required To Apply Fix

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough! 

If an app makes outgoing calls to other systems, please redeploy it. Do this in the usual order for releasing changes (Test, Acceptance, then Production) and check that integrations still work before redeploying Production.

If an app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you. If your application fulfils the requirements for zero-downtime deployments, no downtime will be required.

What to expect after redeploying

If one of the systems an app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. 

In that case, ask the owner of that system to replace its certificate