Generating x509_crt_bundle (IDFGH-5933) #7621

Typoception · 2021-09-30T11:07:39Z

Hi. This issue keeps popping up. I'm no sure how to fix it. I've just installed VSCode and ESP-IDF extension. Tried the project examples (blink) and this appears.

Issue:
Generating x509_crt_bundle
FAILED: esp-idf/mbedtls/x509_crt_bundle
cmd.exe /C "cd /D C:\Users\yahsa\Desktop\NTU\FYP\ESP_Workspace\blink\build\esp-idf\mbedtls && C:\Users\yahsa\esp.espressif\python_env\idf4.3_py3.8_env\Scripts\python.exe C:/Users/yahsa/esp/esp-idf/components/mbedtls/esp_crt_bundle/gen_crt_bundle.py --input C:/Users/yahsa/esp/esp-idf/components/mbedtls/esp_crt_bundle/cacrt_all.pem -q"
gen_crt_bundle.py: Invalid certificate in C:/Users/yahsa/esp/esp-idf/components/mbedtls/esp_crt_bundle/cacrt_all.pem
Invalid certificate
ninja: build stopped: subcommand failed.

Anyone can guide me on how to solve this?

AdityaHPatwardhan · 2021-09-30T11:35:48Z

Hi @Typoception Thank you for the issue. The issue is because one of the certificates in the cacrt_all.pem file has been expired recently ( 30 sep ). That is causing the failure in build.
Can you please disable the following option and try again if it works.
(Top) > Component config > mbedTLS > Certificate Bundle->Enable trusted root certificate bundle

Typoception · 2021-09-30T11:49:00Z

@AdityaHPatwardhan how do i do that? I'm new to vscode. cant seem to find the option.

Typoception · 2021-09-30T11:59:35Z

@AdityaHPatwardhan found it. thanks. finally works.

ghada-sellami · 2021-09-30T12:25:03Z

Hi @Typoception Thank you for the issue. The issue is because one of the certificates in the cacrt_all.pem file has been expired recently ( 30 sep ). That is causing the failure in build. Can you please disable the following option and try again if it works. (Top) > Component config > mbedTLS > Certificate Bundle->Enable trusted root certificate bundle

could you please tell me how to do this? I'm building on terminal on Linux

AStripsTR · 2021-09-30T12:55:23Z

@AdityaHPatwardhan Thank you a lot!

@ghada-sellami in your sdkconfig file you can comment these lines :
CONFIG_MBEDTLS_CERTIFICATE_BUNDLE=y
CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL=y

italocjs · 2021-09-30T22:22:58Z

@AdityaHPatwardhan found it. thanks. finally works.

Where is it?
If anyone is blind like me, it can be found here :)

…essif/esp-idf#7621

felmue · 2021-10-01T09:27:59Z

Hello guys

I also thought the issue stems from the recently expired Let's Encrypt root certificate (DST Root CA X3), but removing it from cacrt_all.pem did not solve the issue for me.

Doing some debugging I found that the EC-ACC certificate (which has not yet expired) seem to be the culprit. Removing that certificate from cacrt_all.pem allows me to compile successfully again.

I have not dug further so I don't know exactly what is wrong with that certificate.

BTW: there are multiple certificates inside cacrt_all.pem which have expired.

Thanks
Felix

felmue · 2021-10-02T07:38:17Z

Hi guys

the issue seems to be that the EC-ACC certificate is using a negative serial number...

7631

Thanks
Felix

Attempt to fix 'gen_crt_bundle.py: Invalid certificate in /home/runner/work/lv_micropython/lv_micropython/esp-idf/components/mbedtls/esp_crt_bundle/cacrt_all.pem' error on build_idf43 test. This happens since the certificate expired. This fix is based on the suggested workaround espressif/esp-idf#7621 (comment)

Error: x509_crt_bundle not found. Due to a certificat expiration espressif/esp-idf#7621 (comment) PlatformIO tab (on the left), Project Tasks > esp32dev > Platform > Run Menuconfig Then: Component config > mbedTLS > Certificate Bundle->Enable trusted root certificate bundle Deactivate the option.

DwangDNguyen · 2021-10-14T15:05:31Z

I build in ESP-IDF 4.2 powershell. How to do this?

italocjs · 2021-10-14T15:09:11Z

I build in ESP-IDF 4.2 powershell. How to do this?

Try running idf.py menuconfig
or editing the config file with a text editor in the project directory (preferably not notepad, maybe vscode or notepad++)

DwangDNguyen · 2021-10-14T15:12:13Z

I build in ESP-IDF 4.2 powershell. How to do this?

Try running idf.py menuconfig or editing the config file with a text editor in the project directory (preferably not notepad, maybe vscode or notepad++)

i running idf.py menuconfig before running idf.py build but still failed

AdityaHPatwardhan · 2021-10-14T17:08:50Z

Hi @DwangDNguyen , can you try adding CONFIG_MBEDTLS_CERTIFICATE_BUNDLE= line in your project's sdkconfig.defaults or sdkconfig file. That will disable the esp_crt_bundle by default.
Just to note here- The fix is already part of the release/v4.2 branch of the esp-idf. You may just update your esp-idf and it should be fixed.
Thanks

DwangDNguyen · 2021-10-15T02:13:32Z

Hi @DwangDNguyen , can you try adding CONFIG_MBEDTLS_CERTIFICATE_BUNDLE= line in your project's sdkconfig.defaults or sdkconfig file. That will disable the esp_crt_bundle by default. Just to note here- The fix is already part of the release/v4.2 branch of the esp-idf. You may just update your esp-idf and it should be fixed. Thanks

Thanks

askdesigners · 2021-10-19T19:33:05Z

For anyone else getting stuck on this, you need to disable the option in the UI menu if you're in VSCode, as the sdkconfig file gets written automatically on build and will nuke your changes.
Also, I just installed this all from scratch today and hit the same error, so I don't think it's fixed in v4.2

mahavirj · 2021-10-21T09:55:11Z

@askdesigners

so I don't think it's fixed in v4.2

Fix is already available on release/v4.2 branch. I would request to check more details on this from #7631 (comment).

Kindly let us know if you are still facing any issues.

ttdever · 2021-10-23T11:04:14Z

For people, who still have this problem:

You can manualy delete EC-ACC certificate from cacrt_all.pem.

Go to ...\esp-idf\components\mbedtls\esp_crt_bundle
Open cacrt_all.pem with any text editor.
Find "EC-ACC"
Delete evrything from "EC-ACC" to "END CERTIFICATE" (like here 4e45f13)

This solved my problem with building 'hello_world' example (I am using release/v4.4)

hoskam-l · 2021-10-23T18:32:28Z

@ttdever Thank you for being so specific.

olsonap · 2021-11-01T18:58:40Z

What worked for me was:
idf.py menuconfig
Component config --->
mbedTLS --->
Certificate Bundle ---> (directly below [ ] Enable mbedTLS debudding)
Uncheck [ ] Enable trusted root certificate bundle

askdesigners · 2021-11-07T10:08:47Z

Yes this issue still persists in the latest version, but following the directions above to disable the cert works to get builds working again.

AdityaHPatwardhan · 2021-11-08T02:37:36Z

Hi @askdesigners, Can you please mention which branch and which commit id you are using, thanks.

rtheil · 2021-11-09T22:19:38Z

This issue still exists in 4.3.1. Brand new install. None of the above suggestions work.

AdityaHPatwardhan · 2021-11-10T04:31:25Z

@rtheil Yes, the release v4.3.1 was released on 9 sep and the issue came around 30 sep ( after a newer version of cryptography module was released). The fix should be a part of the v4.3.2 release.
To fix the problem:

I would recommend you to checkout to the release/v4.3 branch which contains the respective fix.

If that is not possible then as a temporary workaround you can do one of the following steps.
( Please note that below option are temporary and is not recommended for any production env)
Temp Workaround:

You can revert back to earlier version of cryptography (<35) for the time being, refer this change.
You can remove the EC-ACC manually from esp-idf/components/mbedtls/esp_crt_bundle/cacrt_all.pem.
you can refer this change.

askdesigners · 2021-11-10T09:41:56Z

@AdityaHPatwardhan TBH I'm not really sure as I just installed it all according to the tutorial related to the VSCode extension.

AdityaHPatwardhan · 2021-11-10T09:57:47Z

@askdesigners No issues, I think you are using v4.3.1 as it is the latest release. Please refer to my earlier comment for possible solutions.
Thanks

rtheil · 2021-11-10T15:17:33Z

Thanks for the suggestions.

I would recommend you to checkout to the release/v4.3 branch which contains the respective fix.

I've gone through the automated setup in VS Code, and while I attempted to force check out release/v4.3, that results in an error when building

You can revert back to earlier version of cryptography (<35) for the time being, refer this change.

Reverting to cryptography <35 still results in the error, and the compiler seems to continue, but in the end it does not generate the blink.bin file as expected.

You can remove the EC-ACC manually from esp-idf/components/mbedtls/esp_crt_bundle/cacrt_all.pem.
you can refer this change.

After making this change, the project does build, so it seems like you must do both, not just one.

In addition, this change causes this error when setting the device target

( Please note that below option are temporary and is not recommended for any production env)

I am working on projects that will go into production, so building in this way isn't acceptable. What am I to do until a fix is in place?

AdityaHPatwardhan · 2021-11-10T17:01:58Z

Hi @rtheil
While on release/v4.3

Please make sure that you have removed build, sdkconfig, sdkconfig.old from the blink example folder.
After checking out to the release/v4.3 branch, please ensure that you have updated all the submodules ( There must be some option in VS code to do that).

To remove the last error that you mentioned.
Can you please run the necessary install.bat command to install required dependancies, the part of the fix is to lock the cryptography version.

If you are still facing some issue after this then as a last resort you can do following.

perform a clean install of the latest idf version. That should be v4.3.1 ( which still contains the bug ).

a)If you are not using crt_bundle in your project, then please follow this comment to disable crt_bundle for your project. That should fix the issue.
Alternatively,
b) Follow this comment to remove the invalid certificate.

I hope this helps, thanks

Certificate bundle has expired/invalid certs, so disabled as per: See espressif/esp-idf#7621 This should be temporary once ESP-IDF is updated.

paullaffitte · 2021-11-15T15:33:22Z

Why is this issue closed? It's still not fixed.

rtheil · 2021-11-16T19:06:14Z

Why is this issue closed? It's still not fixed.

I believe it's referenced here: UncleRus/esp-idf-lib#251

Certificate bundle has expired/invalid certs, so disabled as per espressif/esp-idf#7621 This should be temporary once ESP-IDF is updated. At present using ESP-IDF 4.3.1.

espressif-bot added the Status: Opened Issue is new label Sep 30, 2021

github-actions bot changed the title ~~Generating x509_crt_bundle~~ Generating x509_crt_bundle (IDFGH-5933) Sep 30, 2021

Typoception closed this as completed Sep 30, 2021

Typoception reopened this Sep 30, 2021

Typoception closed this as completed Sep 30, 2021

tomasmcguinness mentioned this issue Sep 30, 2021

FAILED: esp-idf/mbedtls/x509_crt_bundle (Invalid certificate) (IDFGH-3345) #5322

Closed

bartezz32 mentioned this issue Sep 30, 2021

Compilation error due to missing x509_crt_bundle platformio/platform-espressif32#635

Closed

italocjs mentioned this issue Sep 30, 2021

Cant install ESP Extension on vscode, certificate expired (IDFGH-5936) #7624

Closed

rashedtalukder mentioned this issue Oct 1, 2021

Error building RainMaker Agent firmware m5stack/Core2-for-AWS-IoT-Kit#75

Closed

rashedtalukder pushed a commit to m5stack/Core2-for-AWS-IoT-Kit that referenced this issue Oct 1, 2021

Temporary workaround for #75. Certificate expired as reported in espr…

6107235

…essif/esp-idf#7621

rashedtalukder pushed a commit to m5stack/Core2-for-AWS-IoT-Kit that referenced this issue Oct 1, 2021

Temporary workaround for #75. Certificate expired as reported in espr…

5a60e7f

…essif/esp-idf#7621

kolipakakondal mentioned this issue Oct 1, 2021

Invalid Certificate (IEP-534) espressif/idf-eclipse-plugin#366

Closed

limpens mentioned this issue Oct 1, 2021

CI: "Invalid certificate" error UncleRus/esp-idf-lib#251

Closed

chegewara mentioned this issue Oct 2, 2021

Unable to setup ESP-IDF extension (Certificate has exprired) (IDFGH-5946) #7634

Closed

igrr mentioned this issue Oct 5, 2021

Can't load some certificates with cryptography v35.0.0 (IDFGH-5943) #7631

Closed

Mair mentioned this issue Oct 7, 2021

FAILED: esp-idf/mbedtls/x509_crt_bundle (IDFGH-5972) #7660

Closed

espressif-bot added Status: In Progress Work is in progress Resolution: Done Issue is done internally Status: Done Issue is done internally and removed Status: Opened Issue is new Status: In Progress Work is in progress labels Oct 8, 2021

ua100k mentioned this issue Oct 11, 2021

flasher_args.json file is missing from the build directory, can't proceed, please build properly!! (VSC-766) espressif/vscode-esp-idf-extension#543

Closed

f0rdprefect mentioned this issue Oct 25, 2021

cannot get dev branch to compile on arch linux mmakaay/esphome-xiaomi_bslamp2#64

Closed

This was referenced Dec 22, 2021

ESPIDF build failed while generating x509_crt_bundle Moddable-OpenSource/moddable#757

Closed

fix ESPIDF mbedtls x509_crt_bundle issue Moddable-OpenSource/moddable#758

Closed

binhla mentioned this issue May 4, 2022

Compilation error: undefined reference to `_binary_x509_crt_bundle_start' (IDFGH-7305) #8893

Closed

washishi mentioned this issue Mar 28, 2023

Windows環境でnpm run buildが失敗する stack-chan/stack-chan#136

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Generating x509_crt_bundle (IDFGH-5933) #7621

Generating x509_crt_bundle (IDFGH-5933) #7621

Typoception commented Sep 30, 2021

AdityaHPatwardhan commented Sep 30, 2021

Typoception commented Sep 30, 2021

Typoception commented Sep 30, 2021

ghada-sellami commented Sep 30, 2021

AStripsTR commented Sep 30, 2021

italocjs commented Sep 30, 2021

felmue commented Oct 1, 2021

felmue commented Oct 2, 2021

DwangDNguyen commented Oct 14, 2021

italocjs commented Oct 14, 2021

DwangDNguyen commented Oct 14, 2021

AdityaHPatwardhan commented Oct 14, 2021

DwangDNguyen commented Oct 15, 2021

askdesigners commented Oct 19, 2021

mahavirj commented Oct 21, 2021

ttdever commented Oct 23, 2021

hoskam-l commented Oct 23, 2021

olsonap commented Nov 1, 2021

askdesigners commented Nov 7, 2021

AdityaHPatwardhan commented Nov 8, 2021

rtheil commented Nov 9, 2021

AdityaHPatwardhan commented Nov 10, 2021 •

edited

Loading

askdesigners commented Nov 10, 2021

AdityaHPatwardhan commented Nov 10, 2021

rtheil commented Nov 10, 2021 •

edited

Loading

AdityaHPatwardhan commented Nov 10, 2021

paullaffitte commented Nov 15, 2021

rtheil commented Nov 16, 2021

Generating x509_crt_bundle (IDFGH-5933) #7621

Generating x509_crt_bundle (IDFGH-5933) #7621

Comments

Typoception commented Sep 30, 2021

AdityaHPatwardhan commented Sep 30, 2021

Typoception commented Sep 30, 2021

Typoception commented Sep 30, 2021

ghada-sellami commented Sep 30, 2021

AStripsTR commented Sep 30, 2021

italocjs commented Sep 30, 2021

felmue commented Oct 1, 2021

felmue commented Oct 2, 2021

DwangDNguyen commented Oct 14, 2021

italocjs commented Oct 14, 2021

DwangDNguyen commented Oct 14, 2021

AdityaHPatwardhan commented Oct 14, 2021

DwangDNguyen commented Oct 15, 2021

askdesigners commented Oct 19, 2021

mahavirj commented Oct 21, 2021

ttdever commented Oct 23, 2021

hoskam-l commented Oct 23, 2021

olsonap commented Nov 1, 2021

askdesigners commented Nov 7, 2021

AdityaHPatwardhan commented Nov 8, 2021

rtheil commented Nov 9, 2021

AdityaHPatwardhan commented Nov 10, 2021 • edited Loading

askdesigners commented Nov 10, 2021

AdityaHPatwardhan commented Nov 10, 2021

rtheil commented Nov 10, 2021 • edited Loading

AdityaHPatwardhan commented Nov 10, 2021

paullaffitte commented Nov 15, 2021

rtheil commented Nov 16, 2021

AdityaHPatwardhan commented Nov 10, 2021 •

edited

Loading

rtheil commented Nov 10, 2021 •

edited

Loading