Fix wrong scrape of Root Certificates

certificates/certutils.go

@@ -45,15 +45,15 @@ func ScrapeRootCertificatesFromURL(URL string) (*x509.Certificate, error) {
 		return nil, err
 	}
 
-	peerCertificates := conn.ConnectionState().PeerCertificates
-	if len(peerCertificates) == 0 {
-		err = fmt.Errorf("no peer certificates found at %s", URL)
-		logrus.Error(err)
-		return nil, err
+	chains := conn.ConnectionState().VerifiedChains
+	if len(chains) == 0 {
+		return nil, fmt.Errorf("no certificates found at %s", URL)
 	}
-
-	rootCertificate := peerCertificates[len(peerCertificates)-1]
-	return rootCertificate, nil
+	rootCertificate := chains[len(chains)-1]
+	if len(rootCertificate) == 0 {
+		return nil, fmt.Errorf("no certificates found at %s", URL)
+	}
+	return rootCertificate[len(rootCertificate)-1], nil
 }
 
 // LoadCertificatesFromFile read certificates from the given file. PEM and CER formats

certificates/certutils_test.go

@@ -0,0 +1,14 @@
+package certificates_test
+
+import (
+	"testing"
+
+	"github.com/arduino/arduino-fwuploader/certificates"
+	"github.com/stretchr/testify/require"
+)
+
+func TestScrapeRootCertificatesFromURL(t *testing.T) {
+	cert, err := certificates.ScrapeRootCertificatesFromURL("www.arduino.cc:443")
+	require.NoError(t, err)
+	require.Equal(t, cert.Issuer, cert.Subject)
+}

docs/plugins.md

@@ -94,11 +94,8 @@ Error: reboot mode: upload commands sketch: setting DTR to OFF
 
 #### I flashed the certificates, but I am unable to reach the host
 
-The **whole certificate chain** is needed to make it work. Using
-[`-u` flags](commands/arduino-fwuploader_certificates_flash.md#options) (ex: `-u www.arduino.cc:443`) won’t work because
-it only downloads the root certificates. The solution is to use only the
-[`-f` flag](commands/arduino-fwuploader_certificates_flash.md#options) and provide a pem certificate containing the
-whole chain.
+There was a bug in the arduino-fwuploader prior `2.4.1` which didn't pick the actual root certificate. Upgrading to the
+latest version solves the problem.
 
 #### My antivirus says that `espflash` is a threat