Why can't they rotate ? having root ssh keys on the device doesn't imply the certs don't rotate.

Not necessarily. All they have to do is roll a pub key into the update package. Same as any OTA update.

Do Tesla vehicles get VIN-specific updates?

Not sure - if I was designing it, feels like it would be a good way of getting the right build to the right car so that all the HW versions of each module are in line.

I'd imagine that the update includes all the possible hardware, and the update script actually decides which components to use. Like apt on Debian or yum on RHEL.

Interesting - just found this: https://www.pentestpartners.com/security-blog/reverse-engine...

Not had a chance to read it properly but definitely will be!

That was an amazing read, thank you!

It appears that the Tesla is running a full Ubuntu Linux distro. And here's a small quip to entice passers-by to read more:

  > With names ranging from “INDIFFERENT” to “SUICIDE_BOMBER”, there is a list of escalation strategies in the updater binary, which appear to be strategies for retries of downloads and user prompts on the UI.

My read of the output in the post when they tried to SSH to the device was that Tesla are actually doing the right thing here and using an SSH certificate authority, which allows issuing certificates signed with a private key authorising access to a subset of devices (optionally for a defined period of time). https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Certificate-b... has more information, but in summary unless the private signing key is compromised in some way this is entirely legit. I'd hope that they also have some mechanism for distributing a new public key if the signing key does get compromised but who knows.

I understand there are also certs involved with tesla vehicles communicating with a supercharger as well.