http option changes

Author: zekageri

CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 ## [Unreleased]
 
 ### Fixed
+- Web Push HTTP transport now forwards certificate-bundle / global-CA /
+  common-name TLS options into `esp_http_client`, improving mixed Arduino +
+  ESP-IDF compatibility for provider HTTPS endpoints.
+- Transport failure logs now include endpoint host, path, origin class,
+  `esp_err_t`, and HTTP status for field diagnostics.
 - Fixed ESP32 VAPID key-pair validation and runtime public-key derivation to use the library DRBG-backed mbedTLS path instead of relying on null RNG callbacks.
 - CI now pins PIOArduino Core to `v6.1.19` and installs the ESP32 platform via `pio pkg install`, restoring PlatformIO compatibility with the current `platform-espressif32` package.
 
@@ -13,6 +18,8 @@ All notable changes to this project will be documented in this file.
 - Breaking: renamed `PushMessage.sub` to `PushMessage.subscription` for API consistency.
 - Breaking: removed app-level metadata fields `deviceId`, `disabledTags`, and `deleted` from the transport struct.
 - `validateSubscription()` now validates only the required Web Push transport fields: `endpoint`, `p256dh`, and `auth`.
+- `WebPushConfig` gained transport defaults for `useTlsCertBundle`,
+  `useGlobalCaStore`, and `skipTlsCommonNameCheck`.
 
 ## [2.0.0] - 2026-03-28
 

README.md

@@ -20,6 +20,8 @@ ArduinoJson v7+ is required for the structured payload API.
 - Payload-size guard with the RFC-safe default limit of 3993 bytes.
 - Small per-origin JWT cache to avoid re-signing every message.
 - Configurable queue length, memory caps, retries, timeouts, and worker task settings.
+- Optional TLS transport controls for certificate bundle, global CA store, and
+  common-name verification behavior.
 
 ## Quick Start
 
@@ -143,8 +145,13 @@ if (webPush.isInitialized()) {
 - `ttlSeconds` - Web Push TTL header.
 - `maxRetries`, `retryBaseDelayMs`, `retryMaxDelayMs` - retry/backoff controls.
 - `maxPayloadBytes` - plaintext payload size guard. The default is 3993 bytes; use `0` to disable.
+- `useTlsCertBundle` - attach `esp_crt_bundle_attach` when the build provides the ESP x509 bundle.
+- `useGlobalCaStore` - forward `use_global_ca_store` to `esp_http_client`.
+- `skipTlsCommonNameCheck` - forward `skip_cert_common_name_check` to `esp_http_client`.
 - `networkValidator` - optional callback for application-defined network readiness checks.
 
+The default transport behavior is certificate-bundle-backed (`useTlsCertBundle = true`), which matches common browser push providers such as FCM without extra app wiring.
+
 ## Gotchas
 - System time is required for VAPID JWT expiration.
 - Web Push endpoints require TLS-capable `esp_http_client`.

src/esp_webPush/webPush.h

@@ -138,6 +138,9 @@ struct WebPushConfig {
 	uint32_t retryBaseDelayMs = 1500;
 	uint32_t retryMaxDelayMs = 15000;
 	size_t maxPayloadBytes = 3993;
+	bool useTlsCertBundle = true;
+	bool useGlobalCaStore = false;
+	bool skipTlsCommonNameCheck = false;
 	WebPushNetworkValidator networkValidator;
 };
 

src/esp_webPush/webPush_http.cpp

@@ -1,12 +1,134 @@
 #include "webPush.h"
 
+#include <cctype>
+#include <cstring>
+
 extern "C" {
 #include "esp_http_client.h"
 #include "esp_log.h"
 }
 
+#if __has_include(<esp_crt_bundle.h>)
+extern "C" {
+#include <esp_crt_bundle.h>
+}
+#define ESPWEBPUSH_HAVE_CRT_BUNDLE 1
+#else
+#define ESPWEBPUSH_HAVE_CRT_BUNDLE 0
+#endif
+
 namespace {
 constexpr const char *kTag = "ESPWebPush";
+
+struct EndpointInfo {
+	std::string host;
+	std::string path = "/";
+	const char *originClass = "custom";
+};
+
+bool equalsIgnoreCase(const std::string &lhs, const char *rhs) {
+	if (rhs == nullptr) {
+		return false;
+	}
+
+	const size_t rhsLength = std::strlen(rhs);
+	if (lhs.size() != rhsLength) {
+		return false;
+	}
+
+	for (size_t i = 0; i < lhs.size(); ++i) {
+		if (std::tolower(static_cast<unsigned char>(lhs[i])) !=
+		    std::tolower(static_cast<unsigned char>(rhs[i]))) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
+bool endsWithIgnoreCase(const std::string &value, const char *suffix) {
+	if (suffix == nullptr) {
+		return false;
+	}
+
+	const size_t suffixLength = std::strlen(suffix);
+	if (value.size() < suffixLength) {
+		return false;
+	}
+
+	const size_t start = value.size() - suffixLength;
+	for (size_t i = 0; i < suffixLength; ++i) {
+		if (std::tolower(static_cast<unsigned char>(value[start + i])) !=
+		    std::tolower(static_cast<unsigned char>(suffix[i]))) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
+bool parseEndpointInfo(const std::string &endpoint, EndpointInfo &infoOut) {
+	const size_t schemeSeparator = endpoint.find("://");
+	const size_t authorityStart = schemeSeparator == std::string::npos ? 0 : schemeSeparator + 3;
+	if (authorityStart >= endpoint.size()) {
+		return false;
+	}
+
+	size_t authorityEnd = endpoint.find_first_of("/?#", authorityStart);
+	if (authorityEnd == std::string::npos) {
+		authorityEnd = endpoint.size();
+	} else {
+		infoOut.path = endpoint.substr(authorityEnd);
+	}
+	if (authorityEnd <= authorityStart) {
+		return false;
+	}
+
+	const std::string authority = endpoint.substr(authorityStart, authorityEnd - authorityStart);
+	const size_t userInfoSeparator = authority.rfind('@');
+	const std::string hostAndPort =
+	    userInfoSeparator == std::string::npos ? authority : authority.substr(userInfoSeparator + 1);
+	if (hostAndPort.empty()) {
+		return false;
+	}
+
+	if (hostAndPort.front() == '[') {
+		const size_t closingBracket = hostAndPort.find(']');
+		if (closingBracket == std::string::npos || closingBracket <= 1) {
+			return false;
+		}
+
+		infoOut.host = hostAndPort.substr(1, closingBracket - 1);
+	} else {
+		const size_t portSeparator = hostAndPort.rfind(':');
+		if (portSeparator != std::string::npos &&
+		    hostAndPort.find(':', portSeparator + 1) == std::string::npos) {
+			infoOut.host = hostAndPort.substr(0, portSeparator);
+		} else {
+			infoOut.host = hostAndPort;
+		}
+	}
+
+	if (infoOut.host.empty()) {
+		return false;
+	}
+
+	if (equalsIgnoreCase(infoOut.host, "fcm.googleapis.com") ||
+	    endsWithIgnoreCase(infoOut.host, ".fcm.googleapis.com")) {
+		infoOut.originClass = "fcm";
+	} else if (equalsIgnoreCase(infoOut.host, "updates.push.services.mozilla.com") ||
+	           endsWithIgnoreCase(infoOut.host, ".push.services.mozilla.com")) {
+		infoOut.originClass = "mozilla";
+	} else if (equalsIgnoreCase(infoOut.host, "web.push.apple.com") ||
+	           endsWithIgnoreCase(infoOut.host, ".push.apple.com")) {
+		infoOut.originClass = "apple";
+	} else if (equalsIgnoreCase(infoOut.host, "wns.windows.com") ||
+	           endsWithIgnoreCase(infoOut.host, ".notify.windows.com")) {
+		infoOut.originClass = "windows";
+	}
+
+	return true;
+}
 } // namespace
 
 void ESPWebPush::printHeaderErr(esp_err_t headErr, const char *headKey) const {
@@ -19,17 +141,28 @@ WebPushResult ESPWebPush::sendPushRequest(
     const std::string &endpoint, const std::string &jwt, const std::vector<uint8_t> &body
 ) {
 	WebPushResult result{};
+	EndpointInfo endpointInfo{};
 	if (endpoint.empty()) {
 		result.error = WebPushError::InvalidSubscription;
 		result.message = errorToString(result.error);
 		return result;
 	}
+	if (!parseEndpointInfo(endpoint, endpointInfo)) {
+		endpointInfo.host = endpointOrigin(endpoint);
+	}
 
 	esp_http_client_config_t config = {};
 	config.url = endpoint.c_str();
 	config.method = HTTP_METHOD_POST;
 	config.timeout_ms = static_cast<int>(_config.requestTimeoutMs);
 	config.buffer_size_tx = 6144;
+	config.skip_cert_common_name_check = _config.skipTlsCommonNameCheck;
+	config.use_global_ca_store = _config.useGlobalCaStore;
+#if ESPWEBPUSH_HAVE_CRT_BUNDLE
+	if (_config.useTlsCertBundle) {
+		config.crt_bundle_attach = esp_crt_bundle_attach;
+	}
+#endif
 
 	esp_http_client_handle_t client = esp_http_client_init(&config);
 	if (!client) {
@@ -71,14 +204,47 @@ WebPushResult ESPWebPush::sendPushRequest(
 	if (err != ESP_OK) {
 		result.error = WebPushError::TransportError;
 		result.message = errorToString(result.error);
-		ESP_LOGE(kTag, "HTTP POST failed: %s (status %d)", esp_err_to_name(err), statusCode);
+		ESP_LOGE(
+		    kTag,
+		    "HTTP POST failed: host=%s path=%s origin=%s err=%s(%d) status=%d",
+		    endpointInfo.host.c_str(),
+		    endpointInfo.path.c_str(),
+		    endpointInfo.originClass,
+		    esp_err_to_name(err),
+		    static_cast<int>(err),
+		    statusCode
+		);
+		if (err == ESP_ERR_HTTP_CONNECT) {
+			ESP_LOGE(
+			    kTag,
+			    "TLS/connect setup failed before HTTP response: host=%s path=%s origin=%s",
+			    endpointInfo.host.c_str(),
+			    endpointInfo.path.c_str(),
+			    endpointInfo.originClass
+			);
+		}
 	} else if (statusCode < 200 || statusCode >= 300) {
 		result.error = WebPushError::HttpError;
 		result.message = errorToString(result.error);
-		ESP_LOGE(kTag, "HTTP POST failed: status %d", statusCode);
+		ESP_LOGE(
+		    kTag,
+		    "HTTP POST failed: host=%s path=%s origin=%s status=%d",
+		    endpointInfo.host.c_str(),
+		    endpointInfo.path.c_str(),
+		    endpointInfo.originClass,
+		    statusCode
+		);
 	} else {
 		result.error = WebPushError::None;
 		result.message = errorToString(result.error);
+		ESP_LOGI(
+		    kTag,
+		    "HTTP POST succeeded: host=%s path=%s origin=%s status=%d",
+		    endpointInfo.host.c_str(),
+		    endpointInfo.path.c_str(),
+		    endpointInfo.originClass,
+		    statusCode
+		);
 	}
 
 	esp_http_client_cleanup(client);