Fetch O5 certificates from OSAID Keymanager (2)

[jwoglom]

Re-opened copy of #53

o5-attest-ui2.mov

[jwoglom]

@marionbarker:

Comment

I got this to work with a Trio build - using commit b9bf5e4.
I do not think we want to provide the certificates in clear text.

Details

The Pod UI has a new row:
Pod Certificate Details
When you tap that, you get the full set of certs in plain text.

[jwoglom]

@marionbarker:

Test

✅ Success with Loop
✅ Once cert is downloaded to the app it stays available even through app delete and rebuild

Configuration

I tested again with the latest commit: 2692eec using my feat/add_all_managers branch using instructions from James.
Initially got an error, then did a retry and it worked.

• Delete pump and add it back. It remembers the cert.
• Delete the app and build fresh - it remembers the cert.
• Go to bottom of Pod Certificate Details and forget the cert.

Able to get a new cert (and verified it is different number).

[jwoglom]

(copied comments from previous PR)

[marionbarker]

Test

Configuration

rebuild with OmnipodKit commit 2d2e146

Narrative

Now when I tap Pod Diagnostics, Pod Certificate Details only the public key is shown.
Thanks for the update.

Test phone tests

I did multiple tests forgetting the certificate and getting new ones.
I did this with both Trio and Loop on the same phone.
There is no cross talk between the two apps.
They each get their own certificates.

Personal Test

I built onto my personal Looping phone connected to an O5 pod.
When I tap on Pod Diagnostics, Pod Certificate Details - it says no certificates loaded.
Fortunately, @itsmojo has configured the app to keep working with the current O5 even when you build without certs.
I am still able to do insulin commands with this pod.
When I change next time, I'll be able to load the cert from the keyserver.

[itsmojo]

I did some very quick tests deleting certificates and quickly ran into odd certificate states where “Pod Certificate Details” shows that it has a downloaded certificate, but attempting a pair gets “No certificate found”. This recovery suggestion in this case of “Rebuild app with needed certificate data” is now out of date and needs to either be updated or deleted. The only option presented in this case is a blue “Abort” button that when pressed attempts to deactivate a non-existent pod that must be discarded to recover. This might be fixed or improved in pending OmnipodKit PR #52 (that has been apparently was accidentally deleted!).

In one case, the Pump Manager Details indicates an inconsistent state with a podComms myId and OmniPumpManager controllerId values of 0 instead of the downloaded controller value. In another case, the podComms myId and OmniPumpManager controllerId values were from the previous certificate that had been deleted.

After I got into this state, I tried deleting the certificate, pairing a pod which forces going thru the Omnipod 5 Setup sequence to download a new certificate, and Pair Pod which again failed with a “No certificate found”. But when I tried this sequence yet again, I found that it then did have the controller id info assigned in the podComms myId and OmniPumpManager controllerId and so when I tried pairing, it didn’t get a “No certificate found” error and the O5 pairing was able to proceed. Not very consistent.

I don’t believe that previously with OmnipodKit you could get to the Omnipod 5 view if the O5 pod was selected and there was no available certificates as you would instead be vectored to the Pod Type view and then you’d be forced to select another pod type since the Omnipod 5 would not be even be shown. But with the new ability to download a certificate, the Omnipod 5 Pod Type option should always be shown (if properly built with the ENABLE_O5 option). Then when Omnipod 5 Pod Type is selected, the new “Omnipod 5 Setup” views should be run and an O5 certificate downloaded and saved. I don’t think the user should be able to go directly to the OmniSettingsView menu from “No Pod” on HUD if the O5 type has been selected but there are no available certificates. Rather the OmniUIController logic should take you directly to Pod Type view to select the pod type again and the certificate download if O5 pod type is selected and there isn’t a saved certificate.

The “Omnipod 5 Setup” view text says “We need to briefly connect to the internet to download a certificate in order to pair Omnipod 5 pods. An internet connection won’t be required after you complete this one-time step.” This text could be confusing as the Internet might be required for other things such as Nightscout after setting up an O5 pod. Also, Internet is a proper noun and should be capitalized (and also Insulet likes Pod to be capitalized as well). How about something more along the lines of “This one-time step requires brief Internet access to download a certificate needed to pair Omnipod 5 Pods.”

I’m not so sure about the need for the “Have an ‘.o5keypair’ file to use instead?” button now. And if we are going to have some thing for this capability with a visible button (it could be a hidden option), we probably would want something like geeky sounding.

If there’s no Internet available when you try to download the certificate, the error message displayed is “Failed at step 4 of 6: Requesting server challenge… The Internet connection appears to be offline.” Maybe we should test the Internet connection up front and avoid the verbose “Failed at …” part (or rework things to test if there is a valid Internet connection as step 1). We could also possibly offer some recovery suggestions (e.g., turn on WiFi or Cellular Data).

Since there’s only going to be one certificate in 99.9% cases going forward, why bother having a one line display for the certificate in “Pod Certificate Details” with another screen with the actual info (source, controllerId, public key) and the “Forget Saved Certificate” button instead of just collapse these 2 views into one?

The text when tapping “Forget Saved Certificate” could be augmented to include something explicitly stating that the current O5 pod session will not be affected by this action, but no new Omnipod 5 pods can be paired until ….

Regarding the new Pod Certificate Details button I believe that:

• It should only be shown if the pod type is O5 (it doesn’t make any sense for other pod types)
• It should be moved from the Pod Diagnostics menu to the OmniSettingsView (i.e., the “Omnipod 5” view) which is more consistent with how other pod specific items like this are handled in OmnipodKit (e.g., the Eros specific RileyLink info and the upcoming Dash specific Pod Keep Alive info)
• It should be get renamed to Pod Certificate (as nothing else in the OmniSettingsView is more than 2 words while all commands in Pod Diagnostics are 3 words).

[redacted]

[marionbarker]

Test Browser Build

✅ I did a browser build and determined there was no need to modify the Fastfile to add attributes for getting O5 certs.

• If you install from Testflight (or from Xcode for that matter) onto a phone that has certs, then you are offered all options for pods and can go and get new certs if you forget the ones you have.
• If you forget certs, then delete and add back the pump manager, then only Eros and DASH are offered as expected

Configuration

• iPhone SE 3rd gen that already had gotten certs from the keystore and saved them into my keychain.
• phone had no pump or cgm added
• the build that I did had only OmnipodKit and MinimedKit for pumps and added EversenseKit to the available options for CGM

Narrative

• I added a pump and was offered only 3 choices: Minimed, All Omnipod Types, Simulator
• I selected All Omnipod Types and did the usual onboarding

At first I was puzzled why I was offered O5 but then I remembered - the certs are stored in the keychain for that app on that phone

• Controller ID: 0x002A2010

I then chose Forget Saved Certificate.
I was very puzzled again when it went out and got a new certificate for me.

• Controller ID: 0x00232500

Maybe the build flag is sticky in the app itself.
Yes - that was it. The flag was sticky in the Pump Manager.

• I forgot the Saved Certificate
• I deleted the pump manager
• I added the pump manager back

✅ Now I am only offered the Classic (Eros) and DASH option.

[marionbarker]

I had similar issues as Joe when moving from the version where I built using a data file and paired my pod.

Pod was paired on 11 May with the old build.

I built again on 12 May 2026 using OmnipodKit, commit 2d2e146 with no data file in the clone. After I deactivated, I was automatically taken to get a cert which was successful, but I could not pair.

I deleted the pump manager and added it back and all was fine. (I did not need a new cert - it used the one it got before I deleted the pump manager.)