fix(tls): re-add GlobalSign Root CA R1 for Cloudflare HTTPS - #79
Merged
Conversation
Reaching Bambuddy over HTTPS through Cloudflare (with a CF Access service token)
left the device offline: esp_crt_bundle couldn't verify the certificate
("Failed to verify certificate" / chain too long), though the same request
worked from a laptop. Cloudflare's Google-issued edge certs chain
leaf -> GTS WE1 -> GTS Root R4 -> GlobalSign Root CA (R1)
and Mozilla dropped the 1998 GlobalSign Root CA (R1) from its set, so the
CI-built bundle lost it. esp_crt_bundle matches a trust anchor by the served
chain's TOP issuer (R1) — not the self-signed GTS Root R4 that IS in the Mozilla
set — so it had nothing to match.
gen_ca_bundle.sh now appends GlobalSign Root CA R1 (self-signed, valid to
2028-01-28) before gen_crt_bundle.py, and refuses to build if the embedded
cert's DER SHA-256 doesn't match the pinned value.
Verified from a laptop: openssl s_client -CAfile <globalsign-r1> validates
bambuddy.adrienburaud.fr's live chain (Verify return code: 0). On-device
confirmation to follow over serial after the OTA.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix: Cloudflare HTTPS TLS validation (GlobalSign Root CA R1)
The device couldn't verify Bambuddy's TLS certificate when reached over HTTPS through Cloudflare (with a CF Access service token) —
esp_crt_bundle: Failed to verify certificate— while the same request from a laptop succeeded.Root cause: Cloudflare's Google-issued edge cert chains
leaf -> GTS WE1 -> GTS Root R4 -> GlobalSign Root CA (R1). Mozilla dropped the 1998 GlobalSign Root CA (R1) from its trust store, so the CI-built bundle lost it.esp_crt_bundlematches a trust anchor by the served chain's top issuer (R1), not the self-signed GTS Root R4 that is in the Mozilla set — so it had nothing to match.Fix:
scripts/gen_ca_bundle.shre-appends GlobalSign Root CA R1 (self-signed, valid to 2028-01-28; DER SHA-256 verified at build time) beforegen_crt_bundle.py.Verified from a laptop:
openssl s_client -CAfile <R1>validates the livebambuddy.adrienburaud.frchain (Verify return code: 0). On-device serial confirmation follows after the OTA.🤖 Generated with Claude Code