Use a curated list of certificates that covers most of the Internet. This reduces the certificates size to 20KBs which can be loaded on all boards. The certs file is generated with:https://github.com/arduino/cacert-utils/

Support loading CA certs from the file system.

This patch adds support for automatically loading CA certificates from the filesystem. The file system certs are loaded on the first call to connectSSL(), once, and shared between all sockets.

If filesystem support is not enabled, or CA loading fails, the connection proceeds without error.

Custom CA certificates can still be passed via the 'cert' parameter, and both filesystem and custom certificates are registered with using different TLS tags. This allows users to add their own certs without recreating the whole file.

Testing

Enabled and tested on C33.

iabdalkader added3 commits

November 6, 2025 14:03

libraries/Storage: Update built-in CA data.

ac15a3f

Using a curated list of certificates that covers most ofthe Internet. This reduces the certificates size to 20KBswhich can be loaded on all boards.Created with:https://github.com/arduino/cacert-utils/Signed-off-by: iabdalkader <i.abdalkader@gmail.com>

libraries/SocketWrapper: Support loading CA certs from the file system.

2f256f7

This patch adds support for automatically loading CA certificatesfrom the filesystem. The file system certs are loaded on the firstcall to connectSSL(), once, and shared between all sockets.If filesystem support is not enabled, or CA loading fails, theconnection proceeds without error.Custom CA certificates can still be passed via the 'cert' parameter,and both filesystem and custom certificates are registered withusing different TLS tags. This allows users to add their own certswithout recreating the whole file.Signed-off-by: iabdalkader <i.abdalkader@gmail.com>

variants/arduino_portenta_c33_r7fa6m5bh3cfc: Support loading CA data.

f3ad5b5

Signed-off-by: iabdalkader <i.abdalkader@gmail.com>

iabdalkader changed the title~~Tls ca data~~Support loading CA certs from the file system.

Nov 6, 2025

iabdalkader requested review frompennam andpillo79

November 6, 2025 13:14

iabdalkader changed the title~~Support loading CA certs from the file system.~~libraries/SocketWrapper: Support loading CA certs from the file system.

Nov 6, 2025

pillo79 reviewed

Nov 6, 2025

View reviewed changes

Copy link

pillo79 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Are the changes to C33 config needed to sync that with other boards, or should these be applied more commonly?

Otherwise LGTM!

Copy link

Author

iabdalkader commentedNov 6, 2025

Are the changes to C33 config needed to sync that with other boards, or should these be applied more commonly?

Those options are going to be required by every board and at least 80KBs of heap for mbedtls, if we want to parse and load all of the certificates. I only enabled it for C33 because that's the only one I tested.

Note, I've managed to reduce the certs size from 64KBs to 20KBs withhttps://github.com/arduino/cacert-utils/ the file we have right now needs 140KBs of heap for mbedtls, and at least 64KBs of system heap.