PSA NAC RCC Updates

[sagor]

@sagor: Did you try the official "Citroën Update" software?
For macOS: https://d1tik0o5ahgjm.cloudfront.net/ci ... Update.dmg
For Windows: https://d1tik0o5ahgjm.cloudfront.net/ci ... 0.1.24.exe

This should download the firmware and respective license for your RCC Wave 2 system and prepare the USB flash drive.

Edited:
But you won't be able to install it. The latest firmware version for the RCC Wave 2, 1_076_16.1B116.4, is already 6 years old and has expired signing certificates:

Code: Select all

> openssl smime -in rcc_update\Bosch.cms -pk7out | openssl pkcs7 -print_certs -text | head
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7 (0x7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=FR, L=Paris, O=PSA Peugeot Citroen, OU=Certificate Authorities, OU=(c) PSA Peugeot Citroen - For authorized use only, OU=0002 319187308, CN=PSA - OVIP - Code signing - G1
        Validity
            Not Before: Apr  4 13:02:52 2019 GMT
            Not After : Apr  4 13:02:52 2022 GMT

Just like the NAC Wave 1 and Wave 3 systems, you'll need to wait for PSA/Stellantis to (unlikely) release a new firmware with valid certificates.

Ah so no option to update at all?

[Ikkouma]

Hi,

I have the same issue and would be really grateful for your help and advice.

I have a C4 Cactus 2019 that previously belonged to my mother. I don't believe the software or maps have ever been updated and when I tried to do this using the Citroen.co.uk updates, I am got the infamous "Version not compatible with hardware"..

My local dealership who had sold my mother the car said they don't understand and couldn't help.

And Citroen customer services UK told me there were no map updates for my car, and that if the maps were out of date, I could always use Google Maps!

The current software is: 31.09.4662_NAC-rO

Looking forward to hearing from you.

[subasha]

I have just checked the Citroen update app and it is now showing a version 42.03.33.42 as available. This is after it disappeared for a few weeks. I am downloading it now and will check the certificates to see if they are now valid before attempting update in my vehicle. I shall update on here once I know the info. Fingers crossed that it will work!

Well that didn’t work out as expected. The certificates still expired on 03 November 2024. I shall visit by dealer again on Monday and see if Citroen have replied to the technical ticket that they opened for this issue. I shall keep up you informed of my findings. The main dealers only have access to the same software that we do via the update app so there is no point paying them any money to attempt it.

Hello Rjp1205,

Where did you find that certificates expired on 03 November, 2024?
I really appreciate any help you can provide.

Kind regards,

[subasha]

Hi all,
I have a 2019 C4 Cactus with version 31.09.46.62_NAC-r0.
I would like to update to the latest system and map. I am from Skopje in North Macedonia.
Could you help me with this issue? Thanks in advance.
My VIN is VF7**************[VIN obfuscated, can be read by forum staff]**************[VIN obfuscated, can be read by forum staff]**************[VIN obfuscated, can be read by forum staff].

Hi all,

I also have the "version incompatible with hardware". The Citroen update program says "PSA_ovip-int-firmware-version_42-03-33-42_NAC-r0_NAC_EUR_WAVE3" is the most recent update I need. My car has now version 30-05-50-42_NAC-r0_NAC_EUR_WAVE3. My VIN is VF7**************[VIN obfuscated, can be read by forum staff]**************[VIN obfuscated, can be read by forum staff]**************[VIN obfuscated, can be read by forum staff]. Please has anyone a suggestion?

Best regards,

Both of you have a NAC Wave 3 infotainment system (firmware version 3x.xx.xx.xx), which is impossible to update at this moment (and in the last 6 months or so). This is not related to the license, but to the signing certificates (included in the firmware) that are expired/too old. Only PSA/Stellantis could fix this by issuing new certificates, signing their update with them (the private key), and releasing a new .tar file.

Hello Rui,

Where can we find certificate expiration date?
While using the Citroen Update tool, I found the PSA-OVIP-CS-G1.crt file on the newly created USB location under SWL/00*/Certificate. Are you referring to this one or something else?

Thank you and kind regards,

[RedChili]

I just tried to update my Spacetourer 2019 Firmware as well (always had issues with Apple Carplay and Voice commands), which fails (incompatible hardware) Reading through this thread I found that likely some certificates are expired and thus no update can be performed, although the Citroen App suggests to do so. I'm also wondering what Version (Wave2/3 this car has).
When I export settings from the car I get this:

VIN: VF7**************[VIN obfuscated, can be read by forum staff]

Code: Select all

Package: ovip-int-firmware-version
Version: 31.09.46.62_NAC-r0
Status: install user installed
Architecture: armv7a
Installed-Time: 559

Package: map-eur
Version: 6.3.0-r0
Status: install user installed
Architecture: armv7a
Installed-Time: 96

That firmware version suggests a Wave 3 or a late Wave 2? I found that I should update to 21.08.90.52_NAC-r0, which is despite the lower number a newer firmware for this model?
The official Software Update suggests to update to 42.03.33.42_NAC-r0 (also fails).

Now I really think I'm affected by the old certificates? Could certificate expiry be tricked by changing the NAC's time?
Is the Update Software / Mobile App broken? Why does it suggest to Update to 42.x.x.x when everyone here suggests that 21.08.90.52 is the latest FW for this model?

[Rjp1205]

I have just checked the Citroen update app and it is now showing a version 42.03.33.42 as available. This is after it disappeared for a few weeks. I am downloading it now and will check the certificates to see if they are now valid before attempting update in my vehicle. I shall update on here once I know the info. Fingers crossed that it will work!

Well that didn’t work out as expected. The certificates still expired on 03 November 2024. I shall visit by dealer again on Monday and see if Citroen have replied to the technical ticket that they opened for this issue. I shall keep up you informed of my findings. The main dealers only have access to the same software that we do via the update app so there is no point paying them any money to attempt it.

Hello Rjp1205,

Where did you find that certificates expired on 03 November, 2024?
I really appreciate any help you can provide.

Kind regards,

Hi, I extracted the info below from one of the files. I can’t remember which one off the top of my head.

I used OpenSSL to view the file :-
Validity
Not Before: Nov 3 14:38:04 2021 GMT
Not After : Nov 3 14:38:04 2024 GMT

[rui_saraiva]

Hello Rui,

Where can we find certificate expiration date?
While using the Citroen Update tool, I found the PSA-OVIP-CS-G1.crt file on the newly created USB location under SWL/00*/Certificate. Are you referring to this one or something else?

Thank you and kind regards,

It depends on the hardware. For the NAC, the signed file is "SWL/00*/MediaHeader/MediaVersion.ini" (on RCC systems it's the "rcc_update/Bosch.cms", AIO the "aio_update/Bosch.cms" and RCE the "RCEUpdate.xml" file), so if you run

Code: Select all

openssl smime -in SIGNEDFILE -pk7out | openssl pkcs7 -print_certs -text

(replace the SIGNEDFILE), you should see the validity dates.

The "SWL/00*/Certificates/PSA-OVIP-CS-G1.crt" file is the public key certificate that is used to verify the identity and the authenticity of the software. To digitally sign the software, PSA/Stellantis used the other half of the equation - its PRIVATE key. You can download the latest public key from http://pki.p3cs.com/PSA-OVIP-CS-G1.crt but that's not the problem. The software MUST be digitally signed with the private key that pairs with that certificate, and only PSA/Stellantis has access to that private key.