From 3cbd175d2b8c0fe92b9f0f03ff57da309a43420e Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Mon, 25 May 2026 17:35:04 +0530 Subject: [PATCH] test(mbedtls/crt_bundle): Make weak-hash test self-contained The "custom certificate bundle - weak hash" test relied on DigiCert Global Root CA being present as a trust anchor in cacrt_all.pem (the only SHA-1-self-signed root in the chain it loaded). The recent cacrt_all.pem refresh moved that root to cacrt_deprecated.pem, so the chain could no longer anchor and the test started failing. --- .../test_apps/mbedtls_ut/main/CMakeLists.txt | 3 +- .../mbedtls_ut/main/crts/bad_md_crt.pem | 9 ---- .../mbedtls_ut/main/crts/bad_md_test_bundle | Bin 0 -> 378 bytes .../main/crts/bad_md_test_chain.pem | 44 ++++++++++++++++++ .../mbedtls_ut/main/test_esp_crt_bundle.c | 27 +++++++---- 5 files changed, 65 insertions(+), 18 deletions(-) delete mode 100644 components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_crt.pem create mode 100644 components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_bundle create mode 100644 components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_chain.pem diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/CMakeLists.txt b/components/mbedtls/test_apps/mbedtls_ut/main/CMakeLists.txt index ac099767a0c..2b5140f7f6b 100644 --- a/components/mbedtls/test_apps/mbedtls_ut/main/CMakeLists.txt +++ b/components/mbedtls/test_apps/mbedtls_ut/main/CMakeLists.txt @@ -1,7 +1,8 @@ set(TEST_CRTS "crts/server_cert_chain.pem" "crts/prvtkey.pem" "crts/server_cert_bundle" - "crts/bad_md_crt.pem" + "crts/bad_md_test_chain.pem" + "crts/bad_md_test_bundle" "crts/wrong_sig_crt_esp32_com.pem" "crts/correct_sig_crt_esp32_com.pem" "crts/ecdsa_cert_bundle" diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_crt.pem b/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_crt.pem deleted file mode 100644 index e1a1d307b32..00000000000 --- a/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_crt.pem +++ /dev/null @@ -1,9 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIGijCCBXKgAwIBAgIQAfUXR/1IrnlbCX0+CKqtnDANBgkqhkiG9w0BAQsFADBeMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMR0wGwYDVQQDExRHZW9UcnVzdCBSU0EgQ0EgMjAxODAeFw0yMDA2MTgwMDAwMDBaFw0yMjA5MDExMjAwMDBaMG4xCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhOZXcgWW9yazERMA8GA1UEBxMITmV3IFlvcmsxIDAeBgNVBAoTF0FkYWZydWl0IEluZHVzdHJpZXMgTExDMRcwFQYDVQQDDA4qLmFkYWZydWl0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbW8pXtrCk9RpHdtHRfKx7AgQjH6KMalaUOjeMxI2mqk5oyF/399FQWky/10oeLohivyIv5uror1w0TVon/H946LlTKhT3sbYrpAVDZsfybZF3qD/Sld6kAb0rdb5/TADc0Qy3J0ciCZ6oM3FSDyS7GYnsQ1scw5z82H0unA4ZQQJ1uwa0uIWkpCXyRyb6pidyAj06V7q03EtIQgn8iufV4uncONkp0HVQcuS3uk6RRP26QcdYqBl3OOYHgHeIbANLXgEUDm6cihhPqYRvIFi5jZlmFfEFLvnTgC88iMijCQopaLhWIBos+1lvQT5wzIU/Wj+aqvpWRT05FW4pH/zkCAwEAAaOCAzIwggMuMB8GA1UdIwQYMBaAFJBY/7CcdahRVHex7fKjQxY4nmzFMB0GA1UdDgQWBBTPR/O8QzK2xZ7BH/rN1NLmMNtyizAnBgNVHREEIDAegg4qLmFkYWZydWl0LmNvbYIMYWRhZnJ1aXQuY29tMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPgYDVR0fBDcwNTAzoDGgL4YtaHR0cDovL2NkcC5nZW90cnVzdC5jb20vR2VvVHJ1c3RSU0FDQTIwMTguY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1cy5nZW90cnVzdC5jb20wPQYIKwYBBQUHMAKGMWh0dHA6Ly9jYWNlcnRzLmdlb3RydXN0LmNvbS9HZW9UcnVzdFJTQUNBMjAxOC5jcnQwDAYDVR0TAQH/BAIwADCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHcAKXm+8J45OSHwVnOfY6V35b5XfZxgCvj5TV0mXCVdx4QAAAFyyKMnsAAABAMASDBGAiEApqsw2Iokda11fM2fTA+H4ofSYCaBRUVm4L+DXaldU6ACIQC550v/HYDLUp6a9gugs+tajI/S/9bnSDtfF05IROsOAAB2ACJFRQdZVSRWlj+hL/H3bYbgIyZjrcBLf13Gg1xu4g8CAAABcsijJ6AAAAQDAEcwRQIgJRF0L+7t63eMG/e3kgVKU5rpEZ+A0WUh4A1Wuo8frvoCIQCXj00F2+sTmK1BKo/I1nqOYeaQHeMtlKCJkunJKGannwB2AFGjsPX9AXmcVm24N3iPDKR6zBsny/eeiEKaDf7UiwXlAAABcsijJ+cAAAQDAEcwRQIgItT1DYXAx2uyz1NToQOFqJ2UIL+Dm0nVG40QHL/GVJsCIQCLiBO9MS2PLM/wmufSomt/SDhbLwKFBU9RP8O1qbtV9TANBgkqhkiG9w0BAQsFAAOCAQEANfsWhI00ONyqz5DtuFRxxx4iApmyW7PbQr+9lZuNzkqieNIt/VuCyNIKZEBJ3PA/2QfwvXdIpjE6M7yz+9kh9WdRRg6qj6hPp2gvSQQrk361RY/sTtueAh4re8yyJDebH3B60kUwzNmMms7zcxQ0Ctvg/BDPVBd1VFF/tsoYO4P5iMar1YCl8BNozu6q4JP2E0HRygZD0U7vY2Gsi1wHdm5hVZnLJq6SRTbYUWY3tryEp2lJYQFiSoVfu5icebrLUVRmSl05PyYstjFekb9DCNyyLIBZsjmaFJoJCGo1y5cSqBYfwSsrq1aD9hn5LFeEVG+PEa10IlVv7l+33mLWZA== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIEizCCA3OgAwIBAgIQBUb+GCP34ZQdo5/OFMRhczANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0xNzExMDYxMjIzNDVaFw0yNzExMDYxMjIzNDVaMF4xCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xHTAbBgNVBAMTFEdlb1RydXN0IFJTQSBDQSAyMDE4MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv4rRY03hGOqHXegWPI9/tr6HFzekDPgxP59FVEAh150Hm8oDI0q9m+2FAmM/n4W57Cjv8oYi2/hNVEHFtEJ/zzMXAQ6CkFLTxzSkwaEB2jKgQK0fWeQz/KDDlqxobNPomXOMJhB3y7c/OTLo0lko7geG4gk7hfiqafapa59YrXLIW4dmrgjgdPstU0Nigz2PhUwRl9we/FAwuIMIMl5cXMThdSBK66XWdS3cLX184ND+fHWhTkAChJrZDVouoKzzNYoq6tZaWmyOLKv23v14RyZ5eqoi6qnmcRID0/i6U9J5nL1krPYbY7tNjzgC+PBXXcWqJVoMXcUw/iBTGWzpwwIDAQABo4IBQDCCATwwHQYDVR0OBBYEFJBY/7CcdahRVHex7fKjQxY4nmzFMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBCBgNVHR8EOzA5MDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQAw8YdVPYQI/C5earp80s3VLOO+AtpdiXft9OlWwJLwKlUtRfccKj8QW/Pp4b7h6QAlufejwQMb455OjpIbCZVS+awY/R8pAYsXCnM09GcSVe4ivMswyoCZP/vPEn/LPRhHhdgUPk8MlD979RGoUWz7qGAwqJChi28uRds3thx+vRZZIbEyZ62No0tJPzsSGSz8nQ//jP8BIwrzBAUH5WcBAbmvgWfrKcuv+PyGPqRcc4T55TlzrBnzAzZ3oClo9fTvO9PuiHMKrC6V6mgi0s2sa/gbXlPCD9Z24XUMxJElwIVTDuKB0Q4YMMlnpN/QChJ4B0AFsQ+DU0NCO+f78Xf7 ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsBCSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7PT19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbRTLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/EsrhMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJFPnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0lsYSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQkCAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= ------END CERTIFICATE----- diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_bundle b/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_bundle new file mode 100644 index 0000000000000000000000000000000000000000..d1e87d7b6a226a8a2e7ada67c650f054767ccb06 GIT binary patch literal 378 zcmZQ!U|{fJP-8UkGUPVkWMd9xVH0Kw4K@@t5C(C$cz9fc19UxI+!R7mi%Seu43t2^ z%skRC;qcVNY+aAU;ta3?g`oWW5`!j2B?DeIPOUbNw(q=*jEt-d%uS5^3_x)%rY1&4 zhDFsfjJ?Sd6nvNKy4D&CK4@TJJTjks)v=GhR}Ka)Nid5)ZOvBlc4^=pj}v}-PETHa zPbwoO*e2rNr5U%%f>yB!^r#p|U2+rseV6T^Wm?1shWZar>wn$0p8bC1nokc;eOcQf z?X=rmWrN`4Xcdm2`kh&deo8IPr<)kIGM4KIq+~C~3 z^i5ms>5rH8uY4l^cCUxe%o7b)yq$u5Y}GD$#WZN~ukhqz2ur%&|Cw)ERCu1m%91Xl z#F=-rQtt2^wr0{|J-NvBN8QyR(>ZH5?dn`EWi@Mt`pt(`8+%KpM6=jV+sizqW7WN{ UCSUh0ysWvsSkj+~nUR4J0P+Zuod5s; literal 0 HcmV?d00001 diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_chain.pem b/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_chain.pem new file mode 100644 index 00000000000..c7e524214dc --- /dev/null +++ b/components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_chain.pem @@ -0,0 +1,44 @@ +-----BEGIN CERTIFICATE----- +MIIDwjCCAqqgAwIBAgIUCgyFuL2Y7CNYqmFEBV9RT3FAhF0wDQYJKoZIhvcNAQEL +BQAwSjELMAkGA1UEBhMCVVMxFTATBgNVBAoMDEVTUC1JREYgVGVzdDEkMCIGA1UE +AwwbRVNQLUlERiBXZWFrLUhhc2ggVGVzdCBSb290MCAXDTI2MDUyMTExMDM0OFoY +DzIxMjYwNDI3MTEwMzQ4WjBLMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMRVNQLUlE +RiBUZXN0MSUwIwYDVQQDDBxlc3AtaWRmLXdlYWstaGFzaC10ZXN0LmxvY2FsMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt7RoY7a6ww+BJt5IQPL8EyCn +NfeTw7zs4iTdEjgMFM6KbW9D4p55ihOQ/7aYiPm5Y4OCblQNKcuSrbe2DasDUqEa +uoytNDoUbmvK5MSaJccTVVWbfAjZKBaTi3oMNQQGE/xmXfBE9a76mnddkJQ6x4OP +NApxdf43a4r+mBZEJqdnqQnkv1aIW5TgNSGFhzB+aGc3UO3BKuGDw+z9CTMcFJec +XxrZgGyQDgRfOUnGlnKBTJOYL0OAv92rn+mL1bb8Y/DB1sCHhLKb8YJFsu2w1UX4 +TaMsQFaBby9MqSDkrq+wCFqvMnxsqMb3KJijHQSrWlDT8b7mDuYYqQRlS2evmQID +AQABo4GcMIGZMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG +CCsGAQUFBwMBMCcGA1UdEQQgMB6CHGVzcC1pZGYtd2Vhay1oYXNoLXRlc3QubG9j +YWwwHQYDVR0OBBYEFP5GD4sqAc1YXaRvbjjStdtDlt0+MB8GA1UdIwQYMBaAFGZ9 +kRQcbk29YrhLcVftjoIPqURhMA0GCSqGSIb3DQEBCwUAA4IBAQAs1nL31TQL0wCy +C5zLxVznSw7/lXUIljnMnmNS3dhrYhDsjQ4PQ38rPe6rpUk0yOQQHqgI5BZAZxIo +JQrW+qFnpidyGWHIEt3Xpqm6R7GqbelXw2MvG0MiC6S1WhXqySL/JwMzakEawL00 +gkaUHWZEwqhThTZyBVeqFthBaHUBHfdGZYry21n0DNhuvPzAr2qYXu+NIsJC6bxQ +z+cEpMXzwHKmdylggw30hf6XHkt2Akpcb5rIFce14Tcv9twRTrQvRRgb7JmYtiEs +P40bmckxlPL52LsaJMKM8ew9sTCAu/et0PeVIOXtXIrZuNPo1MSdVxckMX+ZJgCA +EsYxN2H4 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDhzCCAm+gAwIBAgIUVok9cgZsQKuJC59bXAl3DPOAAV0wDQYJKoZIhvcNAQEF +BQAwSjELMAkGA1UEBhMCVVMxFTATBgNVBAoMDEVTUC1JREYgVGVzdDEkMCIGA1UE +AwwbRVNQLUlERiBXZWFrLUhhc2ggVGVzdCBSb290MCAXDTI2MDUyMTExMDM0OFoY +DzIxMjYwNDI3MTEwMzQ4WjBKMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMRVNQLUlE +RiBUZXN0MSQwIgYDVQQDDBtFU1AtSURGIFdlYWstSGFzaCBUZXN0IFJvb3QwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCiexwBjWOQIE2nLUV9MxHggAQB +xJ8HqsbxTdTBUaRgNl/LOwZ07aVR3EjITrzLk6veGmhcUzxY/tKY2nZSqgYQjCQz +WtJGFfvdBsE5ZljwAH/w5X/62zub76ms8uHK9K2IG0K7NySwEZNbJAhSf7lqIU4i +hIPLggC1AXcsEm1RBNzbZYa00HxxUCST4ELtILTYCbul7IZ9y/HSv6nkH+29SEyZ +yIDUS0JTTD0m0UpcgCoPqEkKAFZi14/zDpZaV24YqXSKMmGZ3Cpk3AzDOwIqBcmi +Rfh+1VI1nK2yuomnGjqamCfZ4XqxjXSUWwQ9lr0DlIiq3vU09b6h0ym3cxlPAgMB +AAGjYzBhMB0GA1UdDgQWBBRmfZEUHG5NvWK4S3FX7Y6CD6lEYTAfBgNVHSMEGDAW +gBRmfZEUHG5NvWK4S3FX7Y6CD6lEYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB +/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAgiBC1yyGh/vQkvrf2N757OAskdot +MQvBmBNJbMvFNGuc8bvNBw+wU0EJoZnPmZ14S4HxDjFpd+PCnZBnSDkkPMbShdOY +24HFNXG6A4wlhqQVLOEXWm7hqibjxNfV6BHXf5AuYDrlJPV0pfG1FAjrnk0wmuGh +xiHgZ9n59ZzmlER62jRaGDA12GUR+ChyY3D/PgQoOJvs9zhqWxncGLQnPrQIbgHH +9e73pzCv8rDIYFLGAvz1V4rR4XqVaJm3AIhLQNcQ6wCK6tVvghDm/jEDAfRc4sgF +aUAd5cgFcBhXaxYFbGvm2EbdE8hKVN5SSvJs8qFtcQSgjifHnS+i+axsbQ== +-----END CERTIFICATE----- diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/test_esp_crt_bundle.c b/components/mbedtls/test_apps/mbedtls_ut/main/test_esp_crt_bundle.c index 71d0bab683e..0b01c220012 100644 --- a/components/mbedtls/test_apps/mbedtls_ut/main/test_esp_crt_bundle.c +++ b/components/mbedtls/test_apps/mbedtls_ut/main/test_esp_crt_bundle.c @@ -51,8 +51,11 @@ extern const uint8_t server_pk_end[] asm("_binary_prvtkey_pem_end"); extern const uint8_t server_cert_bundle_start[] asm("_binary_server_cert_bundle_start"); extern const uint8_t server_cert_bundle_end[] asm("_binary_server_cert_bundle_end"); -extern const uint8_t bad_md_crt_pem_start[] asm("_binary_bad_md_crt_pem_start"); -extern const uint8_t bad_md_crt_pem_end[] asm("_binary_bad_md_crt_pem_end"); +extern const uint8_t bad_md_test_chain_pem_start[] asm("_binary_bad_md_test_chain_pem_start"); +extern const uint8_t bad_md_test_chain_pem_end[] asm("_binary_bad_md_test_chain_pem_end"); + +extern const uint8_t bad_md_test_bundle_start[] asm("_binary_bad_md_test_bundle_start"); +extern const uint8_t bad_md_test_bundle_end[] asm("_binary_bad_md_test_bundle_end"); extern const uint8_t wrong_sig_crt_pem_start[] asm("_binary_wrong_sig_crt_esp32_com_pem_start"); extern const uint8_t wrong_sig_crt_pem_end[] asm("_binary_wrong_sig_crt_esp32_com_pem_end"); @@ -420,18 +423,26 @@ TEST_CASE("custom certificate bundle", "[mbedtls]") TEST_CASE("custom certificate bundle - weak hash", "[mbedtls]") { - /* A weak signature hash on the trusted certificate should not stop - us from verifying the chain, since we already trust it a weak signature hash is - not a security issue */ + /* A weak signature hash on the trusted root should not stop verification: + * once the root is trusted, its self-signature hash is not a security issue. + * + * Test fixture: a self-contained SHA-1-self-signed root + leaf generated + * specifically for this test (see crts/bad_md_test_chain.pem and + * crts/bad_md_test_bundle). Self-contained so the test is decoupled from + * cacrt_all.pem churn and from real-world SHA-1 root deprecation. */ mbedtls_x509_crt crt; uint32_t flags = 0; esp_crt_bundle_attach(NULL); + esp_crt_bundle_set(bad_md_test_bundle_start, + bad_md_test_bundle_end - bad_md_test_bundle_start); - mbedtls_x509_crt_init( &crt ); - mbedtls_x509_crt_parse(&crt, bad_md_crt_pem_start, bad_md_crt_pem_end - bad_md_crt_pem_start); - TEST_ASSERT_EQUAL(0, mbedtls_x509_crt_verify(&crt, NULL, NULL, NULL, &flags, esp_crt_verify_callback, NULL)); + mbedtls_x509_crt_init(&crt); + mbedtls_x509_crt_parse(&crt, bad_md_test_chain_pem_start, + bad_md_test_chain_pem_end - bad_md_test_chain_pem_start); + TEST_ASSERT_EQUAL(0, mbedtls_x509_crt_verify(&crt, NULL, NULL, NULL, &flags, + esp_crt_verify_callback, NULL)); mbedtls_x509_crt_free(&crt);