Question regarding CSR Validation about fleet-telemetry

[Bre77]

I hope you get a response from Tesla, but my understanding is that it will perform mutual TLS authenticaiton, without checking what domain the vehicle is actually connecting to (like a web browser would). The certificate is to prove who you are, not what domain its connecting to. This means you should be able to instruct the car to connect to an IP address and everything would still work.

[StephenPorter]

Thanks for the response! Really appreciate the insight.

For those who are interested, Tesla support verified that we had the incorrect CN specified in the request. The CSR should definitely contain the domain name where your .well-known endpoint is hosted.

Also, there is some sensitivity if you have a discrepancy in white space between your hosted com.tesla.3p.public-key.pem and what openssl decodes from the CSR. So make sure to verify with the check_csr.sh script prior to submitting!