octoturge
72ba1e1cdc
Checked BambuStudio's resources/cert/ directly: it ships exactly one LAN-mode CA (the bundled bambu_ca2.pem) plus an unrelated cloud-API leaf cert — no second file to bundle for P1P. So a P1P's certificate is a genuine per-device case, same as older units' 'download it from the printer' flow, and a single Config-wide override path can't express 'most printers use the bundled CA, but this one doesn't'. Config.bambu_ca_cert_path (Option<PathBuf>) -> bambu_ca_cert_overrides (HashMap<printer_id, PathBuf>), parsed from a comma-separated CONTINUUM_BAMBU_CA_CERT_OVERRIDES env var. BambuTls::from_config renamed to ::resolve to make clear it's called once per printer with that printer's own override, not once for the whole config. Verified with cargo check --all-targets and a full run of cargo run --example printer_polymorphism.
1.6 KiB
certs/
bambu_ca2.pem
Bambu Lab's shared root CA ("BBL CA2 RSA") used to verify a printer's LAN-mode MQTTS (port 8883) certificate. Current-generation Bambu printers present a certificate signed by (a chain rooted at) this CA — trust this one file instead of fetching/pinning a certificate per printer.
- Source: https://github.com/bambulab/BambuStudio/blob/master/resources/cert/printer.cer
- Fetched: 2026-08-28
- SHA-256 fingerprint:
E9:8F:19:57:8B:3F:12:4A:CE:6B:8A:24:7F:FE:DA:52:DC:99:C8:9F:D4:E7:D2:0C:82:82:99:77:B7:F3:35:02 - Verified with
openssl x509 -noout -text: self-signed (Issuer == Subject),Basic Constraints: CA:TRUE,Key Usage: Certificate Sign, CRL Sign— a genuine root CA, not a per-device leaf certificate. Valid until 2050.
The "CA2" name implies there was a CA1 generation before it, and at least
one current model — P1P — doesn't chain to this root either: BambuStudio's
resources/cert/ only has this one file (plus an unrelated
*.bambulab.com leaf cert for their cloud API), so there's no second
bundled file to grab for P1P. That means it's a genuine per-device
certificate, the same "download it from the printer" case as the older
units. CONTINUUM_BAMBU_CA_CERT_OVERRIDES (see .env.example) is a
per-printer-id map for exactly this — there's no single fleet-wide
override, because different printers can legitimately need different
certificates at the same time.
If a printer's connection ever fails certificate verification against this file, re-fetch from the source URL above (BambuStudio ships whatever the current fleet needs) and update the fingerprint here.