A possible hackish workaround for us was to downgrade the cryptography package (35.0.0 was just released, the previous version seems to ‘work’):

/opt/espressif/tools/python_env/idf4.3_py3.9_env/bin/pip uninstall -y cryptography 
/opt/espressif/tools/python_env/idf4.3_py3.9_env/bin/pip install cryptography==3.4.8 

substituting the correct path (it seems esp tools at least for us do not use the host pip packages directly)

Hi Guys, This was not obvious to me at first but this is what I did to fix this error on Ubuntu:

1. nano into sdkconfig file <your project>$ nano sdkconfig
2. Find “Certificate Bundle” section
3. Comment out “CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL” (add a “#” in front)
4. Uncomment “CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN” (remove the “#”)
5. Make sure the line displays “CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN=y”
6. Save
7. Build again (idf.py build)

That should solve the issue without having to check all pip cryptography stuff.

Hope this helps someone.

I found this - https://github.com/espressif/esp-idf/issues/7621

The certificates have expired today. This explains how to disable the certificates.

Same issue. ESP-IDF v4.3.1 running ubuntu 20.04. cacrt_all.zip

I was able to build by disabling the “certificate bundle” in the menuconfig as mentioned above.

[ 70%] Linking CXX static library libmbedtls.a
[ 70%] Built target mbedtls
[ 70%] Generating x509_crt_bundle
gen_crt_bundle.py: Invalid certificate in /home/rob/swdev/esp-idf-v4.3.1/components/mbedtls/esp_crt_bundle/cacrt_all.pem
Invalid certificate
make[2]: *** [esp-idf/mbedtls/CMakeFiles/__idf_mbedtls.dir/build.make:67: esp-idf/mbedtls/x509_crt_bundle] Error 2
make[1]: *** [CMakeFiles/Makefile2:2546: esp-idf/mbedtls/CMakeFiles/__idf_mbedtls.dir/all] Error 2
make: *** [Makefile:130: all] Error 2
make failed with exit code 2

% pip3 show cryptography                                                                                                                                                                                                                                                
Name: cryptography
Version: 2.8
Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Home-page: https://github.com/pyca/cryptography
Author: The cryptography developers
Author-email: cryptography-dev@python.org
License: BSD or Apache License, Version 2.0
Location: /usr/lib/python3/dist-packages
Requires: 
Required-by: 
 ~
% pip show cryptography                                                                                                                                                                                                                                                 
Name: cryptography
Version: 2.8
Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Home-page: https://github.com/pyca/cryptography
Author: The cryptography developers
Author-email: cryptography-dev@python.org
License: BSD or Apache License, Version 2.0
Location: /usr/lib/python3/dist-packages
Requires: 
Required-by: 

For anyone using Visual Code on Win10 and following the Getting Started guide, and ends up on this page 😃

Select: View->Command Palette Enter: ESP-IDF SDK Configuration Editor (menuconfig) In the search box on the menuconfig page, enter: “Certificate Bundle” Change setting for “Default certificate bundle options” from “Use the full default certificate bundle” to “Use only the most common certificates from the default bundles”

Voila! Thanks all for the above suggestions!

I have submitted a fix here

To be more precisely, the EC-ACC certificate is invalid. It works after I removed it.

You can do it with idf.py menuconfig as follows: Navigate to Component config --> mbedTLS --> Certificate Bundle --> Default certificate bundle options and choose use only most common certificates, then build again. Good luck!

To be more precisely, the EC-ACC certificate is invalid. It works after I removed it.

The EC-ACC certificate contains a negative serial number:

$ openssl x509 -in ec-acc.pem -text                                                                                               
Certificate:                                                    
    Data:                                                       
        Version: 3 (0x2)                                        
        Serial Number:                                          
             (Negative)11:d4:c2:14:2b:de:21:eb:57:9d:53:fb:0c:22:3b:ff
        Signature Algorithm: sha1WithRSAEncryption

According the the cryptography release doc those values are prohibited.

@ZeRico I had same issue until if fixed the spacing at the beginning to look more like the other lines

I was doing:

#CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL=y
 CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN=y

I changed it to:

# CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL=y
CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN=y

Hi Guys, This was not obvious to me at first but this is what I did to fix this error on Ubuntu:

1. nano into sdkconfig file $ nano sdkconfig

2. Find "Certificate Bundle" section

3. Comment out "CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_FULL" (add a "#" in front)

4. Uncomment "CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN" (remove the "#")

5. Make sure the line displays "CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN=y"

6. Save

7. Build again (idf.py build)

That should solve the issue without having to check all pip cryptography stuff.

Hope this helps someone.

THANKS DUDE, IT WORKS !!!

Hello guys, I am also experiencing the same issue. I attached my compile code. I am on a Windows 10 machine, and reinstalled Eclipse twice (fully). Nothing works. Hope I could receive advice on how to fix the bug. 663 cert error.txt

This can help. https://user-images.githubusercontent.com/9244531/135537815-125dc605-1789-4d8d-84ea-1423b9b31b76.png Similar issues: #7621 , #7624 , #7631

Is there a way to do this on Eclipse IDE? I am not yet familiar with VS code and mid project.

IFAIK the sdkconfig file is the same, you can edit it with any text editor, or run a command on esp-idf cmd that opens a configuration GUI, not sure which command as i never used it.

you can also download the changed file from this commit and paste it into you pc. it will also fix this