ESP32 HTTPS 失败：时间、证书、域名和内存按顺序排查

# POSIX shell · 配合本节前提逐项执行
export LAB_PROJECT="$PWD"
export LAB_BUILD="$HOME/esp32-labs/r04-safe"
python "$IDF_PATH/tools/idf.py" -C "$LAB_PROJECT" -B "$LAB_BUILD" -D SDKCONFIG="$LAB_BUILD/sdkconfig" build
# 确认板型、串口和备份后才自行执行；本文没有执行烧录。
python "$IDF_PATH/tools/idf.py" -C "$LAB_PROJECT" -B "$LAB_BUILD" -p YOUR_SERIAL_PORT flash monitor

# POSIX shell · 配合本节前提逐项执行
python3.12 -m venv "$HOME/esp32-labs/r04-python"
export LAB_PY="$HOME/esp32-labs/r04-python/bin/python"
"$LAB_PY" -m pip install -r tools/requirements.txt
export LAB_PRIVATE="$HOME/esp32-labs/r04-private-$(date +%s)"
"$LAB_PY" tools/generate_lab.py --out "$LAB_PRIVATE" --name esp32-lab.test
cp "$LAB_PRIVATE/lab_ca.pem" certs/lab_ca.pem
# 只复制公开根证书，然后重新build；不复制server.key/lab_ca.key/wrong_ca.key。
"$LAB_PY" tools/fixture_tls.py --lab "$LAB_PRIVATE" --openssl /ABS/PATH/to/openssl3 --out /tmp/r04-fixture-NEW

# POSIX shell · 配合本节前提逐项执行
"$LAB_PY" tools/tls_server.py --cert "$LAB_PRIVATE/server_cert.pem" --key "$LAB_PRIVATE/server.key" --bind YOUR_OWN_LAN_IP --port 8443
# 另一个已激活IDF的终端，进入本工程；文件中填自己的SSID/密码/LAN IP/DNS身份/NTP。
cp sdkconfig.private.example sdkconfig.private
export LAB_TLS_BUILD="$HOME/esp32-labs/r04-private-build"
python "$IDF_PATH/tools/idf.py" -C "$LAB_PROJECT" -B "$LAB_TLS_BUILD" -D SDKCONFIG="$LAB_TLS_BUILD/sdkconfig" -D 'SDKCONFIG_DEFAULTS=sdkconfig.defaults;sdkconfig.private' build
# 确认公开根来自同一私有lab后，自行flash/monitor该目录。

// ---- main/main.c ----
/* SPDX-License-Identifier: MIT */
#include <stdio.h>
#include <string.h>
#include <time.h>
#include <inttypes.h>
#include "sdkconfig.h"
#include "freertos/FreeRTOS.h"
#include "freertos/event_groups.h"
#include "esp_wifi.h"
#include "esp_netif.h"
#include "esp_event.h"
#include "esp_netif_sntp.h"
#include "esp_http_client.h"
#include "esp_heap_caps.h"
#include "esp_timer.h"
#include "nvs_flash.h"
#include "tls_policy.h"
extern const char ca_start[] asm("_binary_lab_ca_pem_start");
static EventGroupHandle_t flags;
static const int IP_OK=1,LINK_FAIL=2;
static void network_event(void *unused,esp_event_base_t base,int32_t id,void *data){
 (void)unused;(void)data;
 if(base==WIFI_EVENT&&id==WIFI_EVENT_STA_START){esp_err_t e=esp_wifi_connect();if(e!=ESP_OK)xEventGroupSetBits(flags,LINK_FAIL);}
 else if(base==WIFI_EVENT&&id==WIFI_EVENT_STA_DISCONNECTED)xEventGroupSetBits(flags,LINK_FAIL);
 else if(base==IP_EVENT&&id==IP_EVENT_STA_GOT_IP)xEventGroupSetBits(flags,IP_OK);
}
typedef struct {size_t bytes,shown;} Body;
static esp_err_t http_event(esp_http_client_event_t *e){
 Body *b=e->user_data;
 if(e->event_id==HTTP_EVENT_ON_DATA&&e->data_len>0){
  size_t n=(size_t)e->data_len;if(n<=SIZE_MAX-b->bytes)b->bytes+=n;else b->bytes=SIZE_MAX;
  size_t show=256-b->shown;if(show>n)show=n;
  if(show){printf("BODY_PREFIX %.*s\n",(int)show,(const char*)e->data);b->shown+=show;}
 }
 return ESP_OK;
}
static void memory(const char *where){printf("MEM %s internal_free=%zu internal_largest=%zu general_free=%zu (overlapping caps, not a sum)\n",where,heap_caps_get_free_size(MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT),heap_caps_get_largest_free_block(MALLOC_CAP_INTERNAL|MALLOC_CAP_8BIT),heap_caps_get_free_size(MALLOC_CAP_8BIT));}
void app_main(void){
 if(!CONFIG_HX_SSID[0]||!CONFIG_HX_HTTPS_URL[0]||!CONFIG_HX_TLS_NAME[0]){puts("CONFIG_DISABLED: no WiFi/TLS request; generate own lab CA and configure private LAN first");return;}
 if(strlen(CONFIG_HX_SSID)>31||strlen(CONFIG_HX_PASSWORD)>63||strncmp(CONFIG_HX_HTTPS_URL,"https://",8)||strstr(CONFIG_HX_SSID,"REPLACE")||strstr(CONFIG_HX_HTTPS_URL,"REPLACE")||strstr(CONFIG_HX_TLS_NAME,"REPLACE")){puts("CONFIG_INVALID: no request, credentials not printed");return;}
 esp_err_t e=nvs_flash_init();if(e!=ESP_OK){printf("NVS_INIT=%s; no erase\n",esp_err_to_name(e));return;}
 flags=xEventGroupCreate();if(!flags){puts("NO_MEMORY_EVENT_GROUP");return;}
 ESP_ERROR_CHECK(esp_netif_init());ESP_ERROR_CHECK(esp_event_loop_create_default());esp_netif_create_default_wifi_sta();
 ESP_ERROR_CHECK(esp_event_handler_register(WIFI_EVENT,ESP_EVENT_ANY_ID,network_event,NULL));ESP_ERROR_CHECK(esp_event_handler_register(IP_EVENT,IP_EVENT_STA_GOT_IP,network_event,NULL));
 wifi_init_config_t w=WIFI_INIT_CONFIG_DEFAULT();ESP_ERROR_CHECK(esp_wifi_init(&w));ESP_ERROR_CHECK(esp_wifi_set_storage(WIFI_STORAGE_RAM));ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA));wifi_config_t c={0};strlcpy((char*)c.sta.ssid,CONFIG_HX_SSID,sizeof c.sta.ssid);strlcpy((char*)c.sta.password,CONFIG_HX_PASSWORD,sizeof c.sta.password);ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA,&c));ESP_ERROR_CHECK(esp_wifi_start());
 EventBits_t bits=xEventGroupWaitBits(flags,IP_OK|LINK_FAIL,pdFALSE,pdFALSE,pdMS_TO_TICKS(10000));
 if(!(bits&IP_OK)||(bits&LINK_FAIL)){puts("LINK_NOT_READY: no TLS request; driver remains initialized, RESET after repair");return;}
 esp_sntp_config_t ntp=ESP_NETIF_SNTP_DEFAULT_CONFIG(CONFIG_HX_NTP_SERVER);ntp.wait_for_sync=true;
 ESP_ERROR_CHECK(esp_netif_sntp_init(&ntp));e=esp_netif_sntp_sync_wait(pdMS_TO_TICKS(10000));time_t utc=time(NULL);bool time_ok=tls_clock_ok(e==ESP_OK,(int64_t)utc);printf("CLOCK sync=%s utc_s=%"PRId64" plausible_and_synced=%u (not authenticated time)\n",esp_err_to_name(e),(int64_t)utc,time_ok);esp_netif_sntp_deinit();
 if(!time_ok){puts("TIME_NOT_READY: keep certificate verification, no HTTPS attempt; RESET after time/network repair");return;}
 Body body={0};esp_http_client_config_t h={.url=CONFIG_HX_HTTPS_URL,.common_name=CONFIG_HX_TLS_NAME,.cert_pem=ca_start,.skip_cert_common_name_check=false,.disable_auto_redirect=true,.timeout_ms=5000,.buffer_size=1024,.buffer_size_tx=1024,.event_handler=http_event,.user_data=&body};
 memory("before_client");esp_http_client_handle_t client=esp_http_client_init(&h);if(!client){puts("HTTP_CLIENT_INIT_FAILED");return;}
 int64_t start=esp_timer_get_time();e=esp_http_client_perform(client);int tls_error=0,verify_flags=0;esp_err_t saved=esp_http_client_get_and_clear_last_tls_error(client,&tls_error,&verify_flags);
 printf("HTTPS result=%s status=%d body_bytes=%zu elapsed_us=%"PRId64" tls_state=%s tls_error=%d verify_flags=0x%08x\n",esp_err_to_name(e),esp_http_client_get_status_code(client),body.bytes,esp_timer_get_time()-start,esp_err_to_name(saved),tls_error,(unsigned)verify_flags);
 ESP_ERROR_CHECK(esp_http_client_cleanup(client));memory("after_client_cleanup");puts("END single request; WiFi/event group remain initialized for inspection until RESET. No periodic retry or insecure fallback.");
}

// ---- main/tls_policy.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include <stdint.h>
#include <stdbool.h>
static inline bool tls_clock_ok(bool synced,int64_t utc){return synced&&utc>=1735689600LL&&utc<4102444800LL;}

# ---- tools/generate_lab.py ----
#!/usr/bin/env python3
# SPDX-License-Identifier: MIT
"""Generate a new private lab, never overwrite. Only lab_ca.pem belongs in firmware."""
import argparse,datetime,ipaddress,json,os,pathlib,hashlib,re
from cryptography import x509
from cryptography.x509.oid import NameOID,ExtendedKeyUsageOID
from cryptography.hazmat.primitives import hashes,serialization
from cryptography.hazmat.primitives.asymmetric import rsa
p=argparse.ArgumentParser();p.add_argument('--out',required=True);p.add_argument('--name',default='esp32-lab.test');a=p.parse_args();out=pathlib.Path(a.out)
label=r'[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?'
if len(a.name)>253 or not re.fullmatch(label+r'(?:\.'+label+r')*',a.name):p.error('valid lowercase ASCII DNS identity required')
try:ipaddress.ip_address(a.name)
except ValueError:pass
else:p.error('DNS identity required, not a numeric IP; IP routing URL is configured separately')
out.mkdir(mode=0o700,parents=True,exist_ok=False)
now=datetime.datetime.now(datetime.timezone.utc);start=now-datetime.timedelta(minutes=5)
def keyfile(name,key):
 f=out/name;f.write_bytes(key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()));os.chmod(f,0o600)
def ca(label):
 key=rsa.generate_private_key(public_exponent=65537,key_size=2048);subject=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,label)])
 cert=x509.CertificateBuilder().subject_name(subject).issuer_name(subject).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(start).not_valid_after(now+datetime.timedelta(days=365)).add_extension(x509.BasicConstraints(ca=True,path_length=0),True).add_extension(x509.KeyUsage(True,False,False,False,False,True,True,False,False),True).add_extension(x509.SubjectKeyIdentifier.from_public_key(key.public_key()),False).sign(key,hashes.SHA256());return key,cert
root,cert=ca('Hixinwu generated local lab CA');wrong,wrong_cert=ca('Different local lab CA');server=rsa.generate_private_key(public_exponent=65537,key_size=2048);subject=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,a.name)])
leaf=x509.CertificateBuilder().subject_name(subject).issuer_name(cert.subject).public_key(server.public_key()).serial_number(x509.random_serial_number()).not_valid_before(start).not_valid_after(now+datetime.timedelta(days=30)).add_extension(x509.BasicConstraints(ca=False,path_length=None),True).add_extension(x509.SubjectAlternativeName([x509.DNSName(a.name)]),False).add_extension(x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVER_AUTH]),False).add_extension(x509.KeyUsage(True,False,True,False,False,False,False,False,False),True).add_extension(x509.AuthorityKeyIdentifier.from_issuer_public_key(root.public_key()),False).sign(root,hashes.SHA256())
for name,obj in [('lab_ca.pem',cert),('wrong_ca.pem',wrong_cert),('server_cert.pem',leaf)]: (out/name).write_bytes(obj.public_bytes(serialization.Encoding.PEM))
keyfile('lab_ca.key',root);keyfile('server.key',server);keyfile('wrong_ca.key',wrong)
manifest={'generatedAt':now.isoformat(),'identity':a.name,'leafNotBefore':leaf.not_valid_before_utc.isoformat(),'leafNotAfter':leaf.not_valid_after_utc.isoformat(),'currentEpoch':int(now.timestamp()),'pastEpoch':int((start-datetime.timedelta(days=1)).timestamp()),'futureEpoch':int((now+datetime.timedelta(days=400)).timestamp()),'publicCertificates':{name:hashlib.sha256((out/name).read_bytes()).hexdigest() for name in ['lab_ca.pem','wrong_ca.pem','server_cert.pem']},'scope':'Generated test CA, not a system trust store. Private keys stay only in this private directory; do not put them in firmware, repo or ZIP.'}
(out/'public-manifest.json').write_text(json.dumps(manifest,indent=2)+'\n');print('Generated private lab at',out,'identity',a.name,'; copy ONLY lab_ca.pem into certs then rebuild. No private key printed.')