trust anchor has expired?

[kryt]

Hi,
I think the trust anchor has expired?

Unable to connect to Telegram server (SSLClient)(SSL_ERROR)(m_start_ssl): Failed to initlalize the SSL layer (SSLClient)(SSL_ERROR)(m_print_br_error): Chain could not be linked to a trust anchor. See https://github.com/OPEnSLab-OSU/SSLClient/blob/master/TrustAnchors.md

Could you provide a new one, or details on how to update it ourself? Thanks! :)

[kryt]

Solved it like as follows, go to:
https://openslab-osu.github.io/bearssl-certificate-utility/

put api.telegram.org to the domain, and generate. Copy-paste contents over tg_certificate.h

[droidprova]

Hello everyone, I have a few projects based on Wemos D1 boards with ESP8266, which I haven't updated in a couple of years, and which have always worked great. Unfortunately, I haven't received a response from my Telegram bots for 3 days. In my code, I use these lines:

#ifdef ESP8266
#include <ESP8266WiFi.h>
BearSSL::WiFiClientSecure client;
BearSSL::Session session;
BearSSL::X509List certificate(telegram_cert);

If the certificate is expired, on ESP8266 not loading the tg_certificate.h file, like in the ESP32, how can I update the expired certificate having only this line:

BearSSL::X509List certificate(telegram_cert)

tnx!

[cotestatnt]

Thanks for reporting this.
The recent TLS failures were caused by Telegram certificate / trust-anchor changes, and the library has now been updated to make this easier to handle and more robust across the different supported client types. The certificate data was reorganized into two dedicated headers.

• Native secure clients on ESP32 / ESP8266 now support an optional built-in recovery path. If a normal TLS connection fails because the stored certificate is no longer valid, the library can fall back to setInsecure() when explicitly enabled by the sketch.
• External TLS stacks such as SSLClient now have a dedicated custom recovery callback API. This is important because SSLClient does not expose the same native setInsecure() behavior as the Espressif secure clients.
• A certificate generation tool was added and can now download Telegram’s certificate chain and regenerate the required headers automatically.

[droidprova]

Grazie 1000 Tolentino! Sempre super operativo!

Appena l'IDE di Arduino rende disponibile il tuo ultimo aggiornamento, aggiorno e testo tutto e ti riporto l'esito.
Pensavo, se

myBot.enableInsecureFallback();

lo si mette in void setup() per rispristinare la connessione con il BOT in mancanza di un certificato valido, bisognerà comunque riavviare manualmente il dispositivo, corretto?