test(mbedtls/crt_bundle): Make weak-hash test self-contained

The "custom certificate bundle - weak hash" test relied on DigiCert
Global Root CA being present as a trust anchor in cacrt_all.pem (the
only SHA-1-self-signed root in the chain it loaded). The recent
cacrt_all.pem refresh moved that root to cacrt_deprecated.pem, so the
chain could no longer anchor and the test started failing.

components/mbedtls/test_apps/mbedtls_ut/main/CMakeLists.txt

@@ -1,7 +1,8 @@
 set(TEST_CRTS "crts/server_cert_chain.pem"
               "crts/prvtkey.pem"
               "crts/server_cert_bundle"
-              "crts/bad_md_crt.pem"
+              "crts/bad_md_test_chain.pem"
+              "crts/bad_md_test_bundle"
               "crts/wrong_sig_crt_esp32_com.pem"
               "crts/correct_sig_crt_esp32_com.pem"
               "crts/ecdsa_cert_bundle"

components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_crt.pem

@@ -1,9 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIGijCCBXKgAwIBAgIQAfUXR/1IrnlbCX0+CKqtnDANBgkqhkiG9w0BAQsFADBeMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMR0wGwYDVQQDExRHZW9UcnVzdCBSU0EgQ0EgMjAxODAeFw0yMDA2MTgwMDAwMDBaFw0yMjA5MDExMjAwMDBaMG4xCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhOZXcgWW9yazERMA8GA1UEBxMITmV3IFlvcmsxIDAeBgNVBAoTF0FkYWZydWl0IEluZHVzdHJpZXMgTExDMRcwFQYDVQQDDA4qLmFkYWZydWl0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbW8pXtrCk9RpHdtHRfKx7AgQjH6KMalaUOjeMxI2mqk5oyF/399FQWky/10oeLohivyIv5uror1w0TVon/H946LlTKhT3sbYrpAVDZsfybZF3qD/Sld6kAb0rdb5/TADc0Qy3J0ciCZ6oM3FSDyS7GYnsQ1scw5z82H0unA4ZQQJ1uwa0uIWkpCXyRyb6pidyAj06V7q03EtIQgn8iufV4uncONkp0HVQcuS3uk6RRP26QcdYqBl3OOYHgHeIbANLXgEUDm6cihhPqYRvIFi5jZlmFfEFLvnTgC88iMijCQopaLhWIBos+1lvQT5wzIU/Wj+aqvpWRT05FW4pH/zkCAwEAAaOCAzIwggMuMB8GA1UdIwQYMBaAFJBY/7CcdahRVHex7fKjQxY4nmzFMB0GA1UdDgQWBBTPR/O8QzK2xZ7BH/rN1NLmMNtyizAnBgNVHREEIDAegg4qLmFkYWZydWl0LmNvbYIMYWRhZnJ1aXQuY29tMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPgYDVR0fBDcwNTAzoDGgL4YtaHR0cDovL2NkcC5nZW90cnVzdC5jb20vR2VvVHJ1c3RSU0FDQTIwMTguY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAmBggrBgEFBQcwAYYaaHR0cDovL3N0YXR1cy5nZW90cnVzdC5jb20wPQYIKwYBBQUHMAKGMWh0dHA6Ly9jYWNlcnRzLmdlb3RydXN0LmNvbS9HZW9UcnVzdFJTQUNBMjAxOC5jcnQwDAYDVR0TAQH/BAIwADCCAX8GCisGAQQB1nkCBAIEggFvBIIBawFpAHcAKXm+8J45OSHwVnOfY6V35b5XfZxgCvj5TV0mXCVdx4QAAAFyyKMnsAAABAMASDBGAiEApqsw2Iokda11fM2fTA+H4ofSYCaBRUVm4L+DXaldU6ACIQC550v/HYDLUp6a9gugs+tajI/S/9bnSDtfF05IROsOAAB2ACJFRQdZVSRWlj+hL/H3bYbgIyZjrcBLf13Gg1xu4g8CAAABcsijJ6AAAAQDAEcwRQIgJRF0L+7t63eMG/e3kgVKU5rpEZ+A0WUh4A1Wuo8frvoCIQCXj00F2+sTmK1BKo/I1nqOYeaQHeMtlKCJkunJKGannwB2AFGjsPX9AXmcVm24N3iPDKR6zBsny/eeiEKaDf7UiwXlAAABcsijJ+cAAAQDAEcwRQIgItT1DYXAx2uyz1NToQOFqJ2UIL+Dm0nVG40QHL/GVJsCIQCLiBO9MS2PLM/wmufSomt/SDhbLwKFBU9RP8O1qbtV9TANBgkqhkiG9w0BAQsFAAOCAQEANfsWhI00ONyqz5DtuFRxxx4iApmyW7PbQr+9lZuNzkqieNIt/VuCyNIKZEBJ3PA/2QfwvXdIpjE6M7yz+9kh9WdRRg6qj6hPp2gvSQQrk361RY/sTtueAh4re8yyJDebH3B60kUwzNmMms7zcxQ0Ctvg/BDPVBd1VFF/tsoYO4P5iMar1YCl8BNozu6q4JP2E0HRygZD0U7vY2Gsi1wHdm5hVZnLJq6SRTbYUWY3tryEp2lJYQFiSoVfu5icebrLUVRmSl05PyYstjFekb9DCNyyLIBZsjmaFJoJCGo1y5cSqBYfwSsrq1aD9hn5LFeEVG+PEa10IlVv7l+33mLWZA==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEizCCA3OgAwIBAgIQBUb+GCP34ZQdo5/OFMRhczANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0xNzExMDYxMjIzNDVaFw0yNzExMDYxMjIzNDVaMF4xCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xHTAbBgNVBAMTFEdlb1RydXN0IFJTQSBDQSAyMDE4MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv4rRY03hGOqHXegWPI9/tr6HFzekDPgxP59FVEAh150Hm8oDI0q9m+2FAmM/n4W57Cjv8oYi2/hNVEHFtEJ/zzMXAQ6CkFLTxzSkwaEB2jKgQK0fWeQz/KDDlqxobNPomXOMJhB3y7c/OTLo0lko7geG4gk7hfiqafapa59YrXLIW4dmrgjgdPstU0Nigz2PhUwRl9we/FAwuIMIMl5cXMThdSBK66XWdS3cLX184ND+fHWhTkAChJrZDVouoKzzNYoq6tZaWmyOLKv23v14RyZ5eqoi6qnmcRID0/i6U9J5nL1krPYbY7tNjzgC+PBXXcWqJVoMXcUw/iBTGWzpwwIDAQABo4IBQDCCATwwHQYDVR0OBBYEFJBY/7CcdahRVHex7fKjQxY4nmzFMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBCBgNVHR8EOzA5MDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQAw8YdVPYQI/C5earp80s3VLOO+AtpdiXft9OlWwJLwKlUtRfccKj8QW/Pp4b7h6QAlufejwQMb455OjpIbCZVS+awY/R8pAYsXCnM09GcSVe4ivMswyoCZP/vPEn/LPRhHhdgUPk8MlD979RGoUWz7qGAwqJChi28uRds3thx+vRZZIbEyZ62No0tJPzsSGSz8nQ//jP8BIwrzBAUH5WcBAbmvgWfrKcuv+PyGPqRcc4T55TlzrBnzAzZ3oClo9fTvO9PuiHMKrC6V6mgi0s2sa/gbXlPCD9Z24XUMxJElwIVTDuKB0Q4YMMlnpN/QChJ4B0AFsQ+DU0NCO+f78Xf7
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsBCSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7PT19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbRTLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/EsrhMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJFPnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0lsYSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQkCAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
------END CERTIFICATE-----

components/mbedtls/test_apps/mbedtls_ut/main/crts/bad_md_test_chain.pem

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIDwjCCAqqgAwIBAgIUCgyFuL2Y7CNYqmFEBV9RT3FAhF0wDQYJKoZIhvcNAQEL
+BQAwSjELMAkGA1UEBhMCVVMxFTATBgNVBAoMDEVTUC1JREYgVGVzdDEkMCIGA1UE
+AwwbRVNQLUlERiBXZWFrLUhhc2ggVGVzdCBSb290MCAXDTI2MDUyMTExMDM0OFoY
+DzIxMjYwNDI3MTEwMzQ4WjBLMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMRVNQLUlE
+RiBUZXN0MSUwIwYDVQQDDBxlc3AtaWRmLXdlYWstaGFzaC10ZXN0LmxvY2FsMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt7RoY7a6ww+BJt5IQPL8EyCn
+NfeTw7zs4iTdEjgMFM6KbW9D4p55ihOQ/7aYiPm5Y4OCblQNKcuSrbe2DasDUqEa
+uoytNDoUbmvK5MSaJccTVVWbfAjZKBaTi3oMNQQGE/xmXfBE9a76mnddkJQ6x4OP
+NApxdf43a4r+mBZEJqdnqQnkv1aIW5TgNSGFhzB+aGc3UO3BKuGDw+z9CTMcFJec
+XxrZgGyQDgRfOUnGlnKBTJOYL0OAv92rn+mL1bb8Y/DB1sCHhLKb8YJFsu2w1UX4
+TaMsQFaBby9MqSDkrq+wCFqvMnxsqMb3KJijHQSrWlDT8b7mDuYYqQRlS2evmQID
+AQABo4GcMIGZMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoG
+CCsGAQUFBwMBMCcGA1UdEQQgMB6CHGVzcC1pZGYtd2Vhay1oYXNoLXRlc3QubG9j
+YWwwHQYDVR0OBBYEFP5GD4sqAc1YXaRvbjjStdtDlt0+MB8GA1UdIwQYMBaAFGZ9
+kRQcbk29YrhLcVftjoIPqURhMA0GCSqGSIb3DQEBCwUAA4IBAQAs1nL31TQL0wCy
+C5zLxVznSw7/lXUIljnMnmNS3dhrYhDsjQ4PQ38rPe6rpUk0yOQQHqgI5BZAZxIo
+JQrW+qFnpidyGWHIEt3Xpqm6R7GqbelXw2MvG0MiC6S1WhXqySL/JwMzakEawL00
+gkaUHWZEwqhThTZyBVeqFthBaHUBHfdGZYry21n0DNhuvPzAr2qYXu+NIsJC6bxQ
+z+cEpMXzwHKmdylggw30hf6XHkt2Akpcb5rIFce14Tcv9twRTrQvRRgb7JmYtiEs
+P40bmckxlPL52LsaJMKM8ew9sTCAu/et0PeVIOXtXIrZuNPo1MSdVxckMX+ZJgCA
+EsYxN2H4
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDhzCCAm+gAwIBAgIUVok9cgZsQKuJC59bXAl3DPOAAV0wDQYJKoZIhvcNAQEF
+BQAwSjELMAkGA1UEBhMCVVMxFTATBgNVBAoMDEVTUC1JREYgVGVzdDEkMCIGA1UE
+AwwbRVNQLUlERiBXZWFrLUhhc2ggVGVzdCBSb290MCAXDTI2MDUyMTExMDM0OFoY
+DzIxMjYwNDI3MTEwMzQ4WjBKMQswCQYDVQQGEwJVUzEVMBMGA1UECgwMRVNQLUlE
+RiBUZXN0MSQwIgYDVQQDDBtFU1AtSURGIFdlYWstSGFzaCBUZXN0IFJvb3QwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCiexwBjWOQIE2nLUV9MxHggAQB
+xJ8HqsbxTdTBUaRgNl/LOwZ07aVR3EjITrzLk6veGmhcUzxY/tKY2nZSqgYQjCQz
+WtJGFfvdBsE5ZljwAH/w5X/62zub76ms8uHK9K2IG0K7NySwEZNbJAhSf7lqIU4i
+hIPLggC1AXcsEm1RBNzbZYa00HxxUCST4ELtILTYCbul7IZ9y/HSv6nkH+29SEyZ
+yIDUS0JTTD0m0UpcgCoPqEkKAFZi14/zDpZaV24YqXSKMmGZ3Cpk3AzDOwIqBcmi
+Rfh+1VI1nK2yuomnGjqamCfZ4XqxjXSUWwQ9lr0DlIiq3vU09b6h0ym3cxlPAgMB
+AAGjYzBhMB0GA1UdDgQWBBRmfZEUHG5NvWK4S3FX7Y6CD6lEYTAfBgNVHSMEGDAW
+gBRmfZEUHG5NvWK4S3FX7Y6CD6lEYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
+/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAgiBC1yyGh/vQkvrf2N757OAskdot
+MQvBmBNJbMvFNGuc8bvNBw+wU0EJoZnPmZ14S4HxDjFpd+PCnZBnSDkkPMbShdOY
+24HFNXG6A4wlhqQVLOEXWm7hqibjxNfV6BHXf5AuYDrlJPV0pfG1FAjrnk0wmuGh
+xiHgZ9n59ZzmlER62jRaGDA12GUR+ChyY3D/PgQoOJvs9zhqWxncGLQnPrQIbgHH
+9e73pzCv8rDIYFLGAvz1V4rR4XqVaJm3AIhLQNcQ6wCK6tVvghDm/jEDAfRc4sgF
+aUAd5cgFcBhXaxYFbGvm2EbdE8hKVN5SSvJs8qFtcQSgjifHnS+i+axsbQ==
+-----END CERTIFICATE-----

components/mbedtls/test_apps/mbedtls_ut/main/test_esp_crt_bundle.c

@@ -51,8 +51,11 @@ extern const uint8_t server_pk_end[]   asm("_binary_prvtkey_pem_end");
 extern const uint8_t server_cert_bundle_start[] asm("_binary_server_cert_bundle_start");
 extern const uint8_t server_cert_bundle_end[] asm("_binary_server_cert_bundle_end");
 
-extern const uint8_t bad_md_crt_pem_start[] asm("_binary_bad_md_crt_pem_start");
-extern const uint8_t bad_md_crt_pem_end[]   asm("_binary_bad_md_crt_pem_end");
+extern const uint8_t bad_md_test_chain_pem_start[] asm("_binary_bad_md_test_chain_pem_start");
+extern const uint8_t bad_md_test_chain_pem_end[]   asm("_binary_bad_md_test_chain_pem_end");
+
+extern const uint8_t bad_md_test_bundle_start[] asm("_binary_bad_md_test_bundle_start");
+extern const uint8_t bad_md_test_bundle_end[]   asm("_binary_bad_md_test_bundle_end");
 
 extern const uint8_t wrong_sig_crt_pem_start[] asm("_binary_wrong_sig_crt_esp32_com_pem_start");
 extern const uint8_t wrong_sig_crt_pem_end[]   asm("_binary_wrong_sig_crt_esp32_com_pem_end");
@@ -420,18 +423,26 @@ TEST_CASE("custom certificate bundle", "[mbedtls]")
 
 TEST_CASE("custom certificate bundle - weak hash", "[mbedtls]")
 {
-    /* A weak signature hash on the trusted certificate should not stop
-       us from verifying the chain, since we already trust it a weak signature hash is
-       not a security issue */
+    /* A weak signature hash on the trusted root should not stop verification:
+     * once the root is trusted, its self-signature hash is not a security issue.
+     *
+     * Test fixture: a self-contained SHA-1-self-signed root + leaf generated
+     * specifically for this test (see crts/bad_md_test_chain.pem and
+     * crts/bad_md_test_bundle). Self-contained so the test is decoupled from
+     * cacrt_all.pem churn and from real-world SHA-1 root deprecation. */
 
     mbedtls_x509_crt crt;
     uint32_t flags = 0;
 
     esp_crt_bundle_attach(NULL);
+    esp_crt_bundle_set(bad_md_test_bundle_start,
+                       bad_md_test_bundle_end - bad_md_test_bundle_start);
 
-    mbedtls_x509_crt_init( &crt );
-    mbedtls_x509_crt_parse(&crt, bad_md_crt_pem_start, bad_md_crt_pem_end - bad_md_crt_pem_start);
-    TEST_ASSERT_EQUAL(0, mbedtls_x509_crt_verify(&crt, NULL, NULL, NULL, &flags, esp_crt_verify_callback, NULL));
+    mbedtls_x509_crt_init(&crt);
+    mbedtls_x509_crt_parse(&crt, bad_md_test_chain_pem_start,
+                           bad_md_test_chain_pem_end - bad_md_test_chain_pem_start);
+    TEST_ASSERT_EQUAL(0, mbedtls_x509_crt_verify(&crt, NULL, NULL, NULL, &flags,
+                                                 esp_crt_verify_callback, NULL));
 
     mbedtls_x509_crt_free(&crt);