mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
gen_crt_bundle.py only parses files ending in .pem or .der, but silently ignored anything else. A PEM certificate named e.g. ca.crt was skipped without a word, and since the build invokes the script with -q, even the "Successfully added 0 certificates" hint was suppressed. The build then succeeded and embedded a bundle without the certificate, and the problem only surfaced at runtime as a TLS verification failure. A file passed directly via --input, which is what CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH points at, is now expected to be a certificate: an unsupported extension raises an InputError and fails the build with a message naming the file and the two accepted extensions. Files found while scanning a directory keep being skipped, as a certificate directory may legitimately contain other files, but a warning is now printed unconditionally so it is visible in the build log. Also document the requirement in the Kconfig help text and in the esp_crt_bundle documentation. Closes https://github.com/espressif/esp-idf/issues/18933