This project uses a curated CA certificate bundle for TLS/SSL verification on the ESP32.

The bundle is sourced from curl’s official CA extract and can optionally be extended with user-provided custom CA certificates.

• The base CA bundle comes from: https://curl.se/docs/caextract.html
• cacert.pem is downloaded directly from curl.se
• A SHA-256 checksum is computed locally and compared against curl’s published checksum
• All certificates are parsed and validated using cryptography
• Any parsing error, mismatch, or invalid certificate aborts generation

⚠️ Trust warning The PEM file and its checksum are fetched from the same domain. If curl.se were compromised or TLS trust failed, both could be malicious but internally consistent. Manual verification against curl’s website is therefore mandatory.

Run:

python3 gen_crt_bundle.py

The script will:

• Download cacert.pem
• Compute its SHA-256 hash
• Download curl’s published checksum
• Verify the PEM matches the computed checksum
• Optionally include custom certificates (see below)
• Abort on any error or inconsistency

⚠️ Do not commit anything before completing the steps below.

1. Open: https://curl.se/docs/caextract.html
2. Locate the latest published SHA-256 checksum
3. Manually compare it against:

sha256sum cacert.pem

Both values must match exactly.

If they do not:

• Do not commit
• Treat the bundle as untrusted

Automatic checks ensure internal consistency. Manual verification establishes the external trust boundary.

After successful manual verification, commit:

• cacert.pem
• x509_crt_bundle

❌ Never commit anything under custom_certs/.

Self-hosted setups may require trusting additional Certificate Authorities (e.g. internal PKI or private reverse proxies).

Custom CA certificates can be added locally and merged into the bundle.

Place certificates in:

custom_certs/

Only files ending in .pem are considered.

Each custom certificate file must contain exactly one PEM certificate block and nothing else.

The script will parse and validate them as CA certificates and reject anything invalid or duplicated.

⚠️ Adding custom CAs expands the ESP32’s trust boundary. Only add certificates you fully trust and control.

If custom_certs/ does not exist or doesn't contain any .pem certificates, only curl’s CA bundle is used.

• Automatic verification protects against corruption and mismatched downloads
• Manual verification anchors trust outside the update mechanism
• Custom certificates explicitly extend trust and are opt-in only
• The generated bundle is deterministic for a given input set

• curl - CA Extract
• Espressif ESP-IDF certificate bundle documentation