Short answer

ESP32 HTTPS client fails certificate verify. Where do I start?

  • Device time must be correct before TLS. Without SNTP, verify fails even when the URL is right.
  • Bundle or embed the right CA. A missing root, or pinning the wrong leaf, fails every request.
  • SNI and the hostname in the URL must match the certificate. IP literals often break verify.
  • Do not disable verify to ‘ship faster’. Fix time and the CA set.

中文

短答

ESP32 HTTPS 校验证书失败，从哪查？

  • TLS 前设备时间要对。没跑 SNTP 时，网址对了也会校验失败。
  • CA 要带对。缺根证书、或钉错叶子证书，每次请求都会挂。
  • SNI 和 URL 主机名要与证书一致。直接写 IP 常常过不了校验。
  • 不要为了出货关掉校验。把时间和 CA 集合改对。