[Question] How to use the builtin certificate bundle for verification?

[ram-bt]

Board

ESP32 Dev Module

Device Description

ESP32 DevKitc V4 - plain module

Hardware Configuration

No

Version

v3.3.10

Type

Question

IDE Name

VSCode

Operating System

Linux

Flash frequency

80Mhz

PSRAM enabled

no

Upload speed

921600

Description

API for using cert bundle requires *bundle and size (expecting application to provide a cert bundle) but i want to use the builtin cert bundle

While looking i saw that NetworkClientSecure lib uses esp_crt_bundle_attach() inside attach_ssl_certificate_bundle. Also during connection start_ssl_client if we pass useRootCABundle true then it will use the cb set by attach_ssl_certificate_bundle. I wanted to use the builtin cert bundle but i can't find a way with the current API for the same. Is this intended design and i'm missing something here?

Sketch

N.A.

Debug Message

N.A.

Other Steps to Reproduce

N.A.

I have checked existing issues, online documentation and the Troubleshooting Guide

• I confirm I have checked existing issues, online documentation and Troubleshooting guide.

[lucasssvaz]

@me-no-dev PTAL

[VectorPeak]

This looks like an API gap rather than something you're missing. In ESP-IDF, the “built-in” certificate bundle is not a ROM/system trust store; it is generated and embedded into the application by Kconfig, then attached with esp_crt_bundle_attach().

As implemented in NetworkClientSecure v3.3.10, the public Arduino API path is for an application-provided bundle:

client.setCACertBundle(bundle, size);

That calls esp_crt_bundle_set(bundle, size) and then enables bundle verification. Passing NULL / 0 currently disables the bundle, so there is no public Arduino API equivalent of “attach the default IDF bundle if one was linked in”.

For normal Arduino sketches, the practical options are:

• use client.setCACert(root_ca_pem) for the specific CA you need
• generate/embed an ESP-IDF-format bundle and pass it to setCACertBundle(bundle, size)
• use Arduino as an ESP-IDF component if you need full menuconfig control over CONFIG_MBEDTLS_CERTIFICATE_BUNDLE

A clean API addition would probably be a no-arg overload or explicit method that only attaches the existing default bundle callback, without calling esp_crt_bundle_set():

client.setBuiltinCACertBundle();

Internally that would just enable esp_crt_bundle_attach() / _use_ca_bundle, and should fail clearly if the bundle was not compiled into the build.

---

If my answer solved your problem, you can click answered the question. I'm really here to help, and along the way I'm also collecting Galaxy Brain badges haha 😆