observer TLS fix

docs/ARCHITECTURE.md

@@ -894,6 +894,8 @@ driver. Persisted in `prefs.json` as `zc.leds_brightness`; it is not part of the
   the station: up at CONNACK, down when the session ends for any reason. Keepalive: PINGREQ once a quarter of
   the 60 s keepalive is left, so a broker that enforces the keepalive without grace does not close an idle
   session.
+  TLS is used without certificate verification, but the chain still has to be parsed: the uplink and observer
+  builds carry P-256 and P-384 with SHA-256 and SHA-384 for that.
 - **`adapters/ota/wifi_ota.c`**: WiFi SoftAP + HTTP firmware upload to MCUboot slot1 (ESP32, requires `--sysbuild`)
 
 Companion transports, as upstream's `companion_radio`: each is a `BaseSerialInterface`

releasenotes/RELEASE_NOTES_1.17.7-zephcore.md

@@ -164,6 +164,10 @@ which resolves #107:
   (Heltec V3, V4, V4.3, Wireless Tracker, Wireless Tracker V2). The node sleeps between beacons once
   it is connected to the broker. It stays awake while it is connecting, and for as long as the WiFi
   network or the broker cannot be reached.
+- **Brokers with a current Let's Encrypt certificate can be reached.** An uplink repeater or an
+  observer joined the WiFi network but never connected to a broker whose certificate chain uses
+  P-384 keys or SHA-384 signatures, which Let's Encrypt's ECDSA certificates do. The firmware does
+  not check the certificate, but it has to read it, and it could not read those. It can now.
 - **An idle connection to the broker is no longer dropped every two minutes.** Some brokers, and TLS
   front ends placed before one, close a connection that has been silent for exactly the keepalive
   time (60 seconds). The keepalive message was sent only when that time was already up, so on a

zephcore/boards/common/observer.conf

@@ -53,6 +53,10 @@ CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
 # TLS 1.2 ciphersuite (auto-selects KEY_EXCHANGE + PSA_WANT_* dependencies)
 CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256=y
 CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256=y
+# P-384 and SHA-384, to parse the broker's certificate chain
+# (devdocs/lld/08-connectivity.md). Same lines in repeater_uplink.conf.
+CONFIG_PSA_WANT_ALG_SHA_384=y
+CONFIG_PSA_WANT_ECC_SECP_R1_384=y
 # TLS 1.2 only (TLS 1.3 causes handshake_failure on most MQTT brokers)
 
 # =========================================================

zephcore/boards/common/repeater_uplink.conf

@@ -43,6 +43,10 @@ CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=4096
 CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
 CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256=y
 CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256=y
+# P-384 and SHA-384, to parse the broker's certificate chain
+# (devdocs/lld/08-connectivity.md). Same lines in observer.conf.
+CONFIG_PSA_WANT_ALG_SHA_384=y
+CONFIG_PSA_WANT_ECC_SECP_R1_384=y
 
 # SNTP (used by ZephyrWiFiStation)
 CONFIG_SNTP=y