mahavir/esp_crt_bundle_data

Readme

# ESP x509 Certificate Bundle Data

[![Component Registry](https://components.espressif.com/components/espressif/esp_crt_bundle_data/badge.svg)](https://components.espressif.com/components/espressif/esp_crt_bundle_data)

Root CA certificate data for the ESP-IDF [X.509 certificate bundle](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-reference/protocols/esp_crt_bundle.html)
(`esp_crt_bundle`). It contains **data only**: the C implementation, the bundle
generator and the Kconfig options stay in ESP-IDF. Shipping the data as a
managed component lets the trusted root list be refreshed independently of
ESP-IDF releases.

## Contents

| File | Purpose |
|---|---|
| `certs/cacrt_all.pem` | Full Mozilla NSS root store, as extracted by curl's `mk-ca-bundle` |
| `certs/cmn_crt_authorities.csv` | Filter list used by `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN` |
| `certs/cacrt_deprecated.pem` | Roots removed from the Mozilla store since the previous major version, opt-in via `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEPRECATED_LIST` |
| `certs/cacrt_local.pem` | Espressif-maintained additions needed for some cross-signed chains |

## Usage

Nothing to configure. When `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE` is enabled, the
ESP-IDF `mbedtls` component depends on this component, the IDF Component
Manager fetches it into `managed_components/`, and the bundle embedded in the
application is generated from `certs/` instead of the snapshot in
`$IDF_PATH/components/mbedtls/esp_crt_bundle`. With the component manager
disabled, the in-tree snapshot is used.

`esp_crt_bundle_attach()` and all `CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_*` options
behave exactly as before. To pick up a newer root list after it is published,
run `idf.py update-dependencies`.

## Versioning

- **Minor** release: roots added, or metadata changes.
- **Major** release: one or more roots removed from the default list. Removed
  roots move to `cacrt_deprecated.pem` for one major version.

Pinning `^1` therefore never silently drops a trusted root.

## How this component works

`project_include.cmake` sets the `ESP_CRT_BUNDLE_DATA_DIR` build property to
its `certs/` directory. The ESP-IDF mbedtls component reads that property
when generating the bundle and falls back to its in-tree snapshot when the
property is absent.