From 1fb9737f95ac8edb2bea86bd75b11867cc91a633 Mon Sep 17 00:00:00 2001 From: Jared Dohrman Date: Sun, 19 Jul 2026 13:06:46 +1000 Subject: [PATCH] fix(mqtt): trust GTS WE1 for eastmesh/meshmapper broker TLS mqtt2.eastmesh.au switched from a Let's Encrypt cert to a Google Trust Services WE1-issued *.eastmesh.au wildcard (July 2026), so devices on the pinned-PEM fallback path failed the handshake with mbedTLS -9984. Pin the combined ISRG Root X1 + GTS WE1 bundle for these brokers so either chain verifies. Co-Authored-By: Claude Fable 5 --- src/helpers/mqtt/MQTTCaCerts.h | 3 ++- src/helpers/mqtt/MQTTUplink.cpp | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/helpers/mqtt/MQTTCaCerts.h b/src/helpers/mqtt/MQTTCaCerts.h index 336d6996..d0c8e298 100644 --- a/src/helpers/mqtt/MQTTCaCerts.h +++ b/src/helpers/mqtt/MQTTCaCerts.h @@ -2,7 +2,8 @@ namespace mqtt_ca_certs { -// EastMesh currently presents a Let's Encrypt E7-issued certificate. +// EastMesh presented a Let's Encrypt E7-issued certificate until July 2026, +// when it moved to a Google Trust Services WE1 wildcard (see kCombinedPem). static const char kEastmeshIsrgRootX1Pem[] = R"PEM(-----BEGIN CERTIFICATE----- MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw diff --git a/src/helpers/mqtt/MQTTUplink.cpp b/src/helpers/mqtt/MQTTUplink.cpp index 5a1ef954..26868856 100644 --- a/src/helpers/mqtt/MQTTUplink.cpp +++ b/src/helpers/mqtt/MQTTUplink.cpp @@ -202,7 +202,9 @@ const char* MQTTUplink::brokerCaCert(const BrokerSpec& spec) { // Note: ESP32 targets with the certificate bundle attach it instead of these PEMs; // this fallback only applies on builds without CONFIG_MBEDTLS_CERTIFICATE_BUNDLE. if (spec.bit == kEastmeshBit || spec.bit == kMeshmapperBit) { - return mqtt_ca_certs::kEastmeshIsrgRootX1Pem; // Let's Encrypt ISRG Root X1 + // eastmesh.au switched from Let's Encrypt to a Google Trust Services WE1 + // wildcard cert (July 2026); trust both so a switch back doesn't brick uplinks. + return mqtt_ca_certs::kCombinedPem; // ISRG Root X1 + GTS WE1 } // waev (mqtt.waev.app) presents a Google Trust Services WE1 chain, same issuer as LetsMesh. return mqtt_ca_certs::kLetsmeshWe1Pem; // Google Trust Services WE1