tfaour
5588ce3e1b
Build and push server image / build-and-push (push) Successful in 33s
Root-caused the earlier "No matching trusted root certificate found" failure properly this time by reading ESP-IDF's actual bundle-matching code (esp_crt_bundle.c): it looks up a trusted root by the ISSUER name of whatever certificate it can't otherwise validate, not by matching the presented certificate itself. The live server's chain ends in a GTS Root R4 certificate cross-signed by the old GlobalSign Root CA R1 (common Cloudflare/Google Trust Services practice, for compatibility with older/embedded clients) -- and ESP-IDF's current bundle snapshot has dropped that old GlobalSign root entirely, so the lookup came up empty. This was a general gap, not something specific to this one deployment's cert. Fix: keep the standard public CA bundle (esp_crt_bundle_attach) as the trust mechanism -- so any normal reverse-proxy cert (Let's Encrypt, etc.) works out of the box -- and add the one missing root on top via ESP-IDF's CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE mechanism (sdkconfig.defaults), which appends a project-supplied cert file to the bundle at build time. Fetched GlobalSign's official Root CA R1 cert and cryptographically verified (openssl verify) it actually validates the live server's certificate before embedding it -- see firmware/main/certs/additional_root_ca.pem (replaces the old tools_server_ca.pem, which pinned one exact certificate directly and would've broken for anyone else's reverse proxy). Confirmed working against the real deployment on hardware.