octoturge
305c41993d
README/certs/README/.env.example/printers.example.toml were all still describing this as a learning-stage stub with no real printer protocol clients - rewritten to reflect the real Bambu MQTT client, cert auto-pinning, and marlin serial connection that now exist. - Remove examples/fetch_bambu_cert.rs: its manual fetch-and-save workflow is now what BambuPrinter::connect()'s ensure_trusted does automatically on every connect, so it has no remaining use case. - Fix examples/printer_polymorphism.rs, which no longer compiled - dispatch_gcode was replaced by real methods earlier this session; swapped in print_status() as the vendor-only-extension example. - Remove Config::bambu_ca_cert_overrides/bambu_require_valid_cert and the .env vars documenting them - confirmed dead (nothing read them), fully superseded by printers.toml's per-printer ca_cert_path/ require_valid_cert plus automatic trust-on-first-connect pinning. - Fix stale doc comments in printer/mod.rs and printer/bambu.rs that described certificate trust and MQTT as not built yet, or referencing the now-removed example. No behavior change in the daemon itself - verified with cargo build --examples and a live run of printer_polymorphism and auto_connect_bambu against the real P1P/H2C printers.
44 lines
2.3 KiB
Markdown
44 lines
2.3 KiB
Markdown
# certs/
|
|
|
|
## bambu_ca2.pem
|
|
|
|
Bambu Lab's shared root CA ("BBL CA2 RSA") used to verify a printer's LAN-mode
|
|
MQTTS (port 8883) certificate. Current-generation Bambu printers present a
|
|
certificate signed by (a chain rooted at) this CA - trust this one file
|
|
instead of fetching/pinning a certificate per printer.
|
|
|
|
- Source: https://github.com/bambulab/BambuStudio/blob/master/resources/cert/printer.cer
|
|
- Fetched: 2026-08-28
|
|
- SHA-256 fingerprint: `E9:8F:19:57:8B:3F:12:4A:CE:6B:8A:24:7F:FE:DA:52:DC:99:C8:9F:D4:E7:D2:0C:82:82:99:77:B7:F3:35:02`
|
|
- Verified with `openssl x509 -noout -text`: self-signed (`Issuer == Subject`),
|
|
`Basic Constraints: CA:TRUE`, `Key Usage: Certificate Sign, CRL Sign` - a
|
|
genuine root CA, not a per-device leaf certificate. Valid until 2050.
|
|
|
|
The "CA2" name implies there was a CA1 generation before it, and at least
|
|
one current model - P1P - doesn't chain to this root either: BambuStudio's
|
|
`resources/cert/` only has this one file (plus an unrelated
|
|
`*.bambulab.com` leaf cert for their cloud API), so there's no second
|
|
bundled file to grab for P1P. That means it's a genuine per-device
|
|
certificate, the same "download it from the printer" case as the older
|
|
units. `CONTINUUM_BAMBU_CA_CERT_OVERRIDES` (see `.env.example`) is a
|
|
per-printer-id map for exactly this - there's no single fleet-wide
|
|
override, because different printers can legitimately need different
|
|
certificates at the same time.
|
|
|
|
If a printer's connection ever fails certificate verification against this
|
|
file, re-fetch from the source URL above (BambuStudio ships whatever the
|
|
current fleet needs) and update the fingerprint here.
|
|
|
|
## `pinned/`
|
|
|
|
Not checked in (gitignored) - where `BambuPrinter::ensure_trusted` saves a
|
|
certificate it auto-pinned via trust-on-first-connect, one file per
|
|
printer, named `<serial number>.pem`. This only happens for a printer
|
|
whose certificate doesn't verify against `bambu_ca2.pem` above (P1P, at
|
|
least) and that doesn't already have an explicit `ca_cert_path` set in
|
|
`printers.toml` - see that method's doc comment in `src/printer/bambu.rs`
|
|
for the full trust-on-first-connect flow, and the SSH-host-key analogy it's
|
|
built on. Delete a printer's file here to force it to re-pin (a real
|
|
error, not silent, if the certificate it captures the second time still
|
|
doesn't verify) the next time it connects.
|