Max API URL change and Russian Ministry of Digital Development certificates

Colleagues, if you develop bots for Max or just have some running there, a reminder: starting tomorrow you have to use the new API URL: https://platform-api2.max.ru.

You'll also need to add the Russian Ministry of Digital Development certificates to the host's trusted ones, since the new API URL works with exactly these certificates.

How to update the certificates

In these examples I download the certificates into build/certs/ because I then add them to docker containers from there, but you can download them wherever you like.

1. Download the current files (the official source is gu-st.ru; its own certificate is signed by the same CA, so you have to disable verification with the -k flag):

   curl -k -o build/certs/russian_trusted_root_ca.cer \
      "https://gu-st.ru/content/Other/doc/russian_trusted_root_ca.cer"
   curl -k -o build/certs/russian_trusted_sub_ca.cer \
      "https://gu-st.ru/content/Other/doc/russian_trusted_sub_ca.cer"

2. Check that you got something meaningful (a valid certificate with the expected subject/issuer):

   openssl x509 -in build/certs/russian_trusted_root_ca.cer -noout -subject -issuer -enddate
   openssl x509 -in build/certs/russian_trusted_sub_ca.cer  -noout -subject -issuer -enddate

   Expected subject/issuer:

   • root: subject = issuer = C=RU, O=The Ministry of Digital Development and Communications, CN=Russian Trusted Root CA
   • sub: subject = C=RU, ... CN=Russian Trusted Sub CA, issuer = ... CN=Russian Trusted Root CA

3. In the Dockerfile I add

   COPY ./build/certs/russian_trusted_root_ca.cer /usr/local/share/ca-certificates/russian_trusted_root_ca.crt
   COPY ./build/certs/russian_trusted_sub_ca.cer /usr/local/share/ca-certificates/russian_trusted_sub_ca.crt
   RUN update-ca-certificates

   and the certificates get installed in the containers that need them.

You can also download the certificates from the Gosuslugi page.