OAuth2 Provider Let's Encrypt Certificate No Longer Supported #400
Description
According to the official documentation, Let's Encrypt SSL certificate cannot be used by the OAuth2 server involved in the skill account linking process anymore.
At this point, it's not very clear if this is actually enforced. The official skill uses such certificate without any issue. Lately, it appears that some additional undocumented security requirements were added for newly created skills but don’t seem to be enforced for existing ones yet.
While it may appear that the certificate restriction is now in place for newly created skills, it looks like setting your reverse proxy server SSL ciphers setting to ALL still allows the account linking process to complete successful using a LE certificate. Moreover, reverting back that setting to its original more strict value still allows that process to complete, as it seems that Amazon is doing some caching on their end. Currently, it’s hard to pinpoint which exact SSL ciphers Amazon is looking for and if there are actually enforcing this documented restriction for smart home skills.
Ultimately, if the above workaround doesn't work, the solution for private skill instances using a private Cloud connector, is to use the Amazon LWA OAuth2 provider option and add their Cloud connector account username and password to the skill configuration file as described in the readme file.
It is important to note that this is only affecting the OAuth2 authorization process and such restriction doesn't apply to the communication between the skill Lambda function and your OH server where LE certificates can be used without any issues.