cloud mqtt: honor lan_tls_skip_verify

Cloud MQTT now verifies chain and hostname on every platform, which
breaks behind a TLS-inspecting proxy whose root is not in the vendored
bundle, or once that bundle goes stale. lan_tls_skip_verify (and
OBN_SKIP_TLS_VERIFY) now disables both checks for cloud MQTT too, so
there is an escape hatch without a rebuild. The effective setting is
logged on connect as tls_verify=0/1.

Docs: obn.conf template, README and STATUS describe the wider scope and
no longer claim slicer_base64.cer is used for Windows cloud MQTT.

README.md

@@ -456,7 +456,7 @@ Spaces around `=` are optional.
 
 | Key | Default | Effect |
 | --- | --- | --- |
-| `lan_tls_skip_verify` | `0` | Skip TLS certificate verification for LAN MQTT/FTPS connections. |
+| `lan_tls_skip_verify` | `0` | Skip TLS certificate verification for LAN MQTT/FTPS connections. Despite the name, also disables certificate and hostname checks for cloud MQTT — a last resort for TLS-inspecting proxies or a stale built-in CA bundle (Windows). |
 | `override_lan_ip` | `0` | Replace the printer's self-reported LAN IP in push_status with the IP used in connect_printer. Enable for NAT / port-forwarding setups where the printer advertises its internal address. |
 | `mqtt_keep_connection` | `1` | Keep the MQTT connection alive across the slicer's internal disconnect/reconnect cycles (e.g. after sending a print job). Avoids 5-30s reconnection delays on printers with limited MQTT session slots. Useful for Orca Slicer. |
 

STATUS.md

@@ -48,7 +48,7 @@ Source: [src/abi_meta.cpp](src/abi_meta.cpp), [src/abi_lifecycle.cpp](src/abi_li
 | `bambu_network_destroy_agent` | ✅ | Deletes the agent instance. |
 | `bambu_network_init_log` | ✅ | No-op here: log sinks are configured inside `create_agent`, before the first log line. |
 | `bambu_network_set_config_dir` | ✅ | Stored on the agent; used for auth cache, device-cert snapshots, and `<config_dir>/obn.env` (IPC to `libBambuSource`). Also publishes `OBN_CONFIG_DIR` in the process environment. |
-| `bambu_network_set_cert_file` | ✅ | Studio passes `resources/cert/` + `slicer_base64.cer` (ABI). LAN uses **`printer.cer`** from that folder (synced to env + `obn.env` as `OBN_LAN_TLS_CA_FILE`); **`slicer_base64.cer`** is stored for Windows cloud MQTT only (see [research §10.6](research/10.06-lan-tls-and-access-codes.md)). |
+| `bambu_network_set_cert_file` | ✅ | Studio passes `resources/cert/` + `slicer_base64.cer` (ABI). LAN uses **`printer.cer`** from that folder (synced to env + `obn.env` as `OBN_LAN_TLS_CA_FILE`); **`slicer_base64.cer`** is stored but unused (see [research §10.6](research/10.06-lan-tls-and-access-codes.md)). Cloud MQTT verifies chain + hostname against the system trust store (Linux/macOS) or a vendored Mozilla CA bundle written to `<config_dir>/obn_cloud_ca.pem` (Windows); `lan_tls_skip_verify = 1` turns that off too. |
 | `bambu_network_set_country_code` | ✅ | Stored; drives cloud region selection (`api_host`, `web_host`). |
 | `bambu_network_start` | ✅ | Starts worker threads. If a cached session is present the plugin also kicks off `connect_cloud()` here — the stock call chain normally goes through `EVT_USER_LOGIN_HANDLE`, but that cascade can silently stall for cached sign-ins; starting from `start()` guarantees cloud MQTT gets initiated. |
 

packaging/obn.conf.in

@@ -26,6 +26,10 @@ bambusource_log_file =
 # --- LAN TLS --------------------------------------------------------
 #
 # Skip TLS certificate verification for LAN MQTT/FTPS connections.
+# Despite the name, this also disables certificate and hostname checks on
+# the cloud MQTT connection. Use it as a last resort when cloud MQTT fails
+# TLS verification, e.g. behind a TLS-inspecting corporate proxy or when
+# the CA bundle built into the plugin (Windows) has gone stale.
 
 lan_tls_skip_verify = 0
 

src/agent.cpp

@@ -2738,12 +2738,15 @@ int Agent::connect_cloud()
     //     verification (CloudSession::start() no longer skips either
     //     check now that this hands it a trust anchor that actually
     //     validates the real chain).
+    //   - lan_tls_skip_verify = 1 disables both checks on every platform,
+    //     for TLS-inspecting proxies or a stale bundle.
     std::string cloud_ca;
 #if defined(_WIN32)
     cloud_ca = obn::tls::ensure_cloud_ca_bundle_file(config_dir());
     if (cloud_ca.empty()) {
         OBN_WARN("connect_cloud: failed to write vendored CA bundle; "
-                  "cloud MQTT connect will likely fail on Windows");
+                  "cloud MQTT connect will likely fail on Windows unless "
+                  "lan_tls_skip_verify = 1");
     }
 #endif
     cloud_session_->configure(cloud_region(), s.user_id, s.access_token,

src/cloud_session.cpp

@@ -2,6 +2,7 @@
 
 #include "obn/bambu_networking.hpp"
 #include "obn/config.hpp"
+#include "obn/lan_tls.hpp"
 #include "obn/log.hpp"
 #include "obn/mqtt_client.hpp"
 
@@ -194,16 +195,24 @@ int CloudSession::start(ConnectedCb on_connected,
     cfg.password     = token;
     cfg.use_tls      = true;
     // Cloud broker runs a real, publicly-trusted (DigiCert) cert, so we
-    // always verify both the chain and the hostname. On Windows, ca_file
-    // (below) is Agent::connect_cloud's vendored standard CA bundle
+    // verify both the chain and the hostname. On Windows, ca_file (below)
+    // is Agent::connect_cloud's vendored standard CA bundle
     // (obn::tls::kCloudCaBundlePem) rather than a Bambu-specific one, so
-    // it actually chains -- no need to skip either check here.
-    cfg.tls_insecure = false;
-    cfg.ca_file      = ca_file; // optional override; empty -> system store
-    cfg.keepalive_s  = 60;
+    // it actually chains.
+    //
+    // lan_tls_skip_verify / OBN_SKIP_TLS_VERIFY turns both checks off here
+    // too: it is the escape hatch for a TLS-inspecting proxy whose root is
+    // not in the vendored bundle, or for a bundle that has gone stale.
+    const bool verify         = obn::lan_tls::verify_enabled();
+    cfg.tls_insecure          = !verify;
+    cfg.tls_skip_chain_verify = !verify;
+    cfg.ca_file               = ca_file; // optional override; empty -> system store
+    cfg.keepalive_s           = 60;
 
-    OBN_INFO("cloud mqtt: connecting to %s:%d as u_%s (token=%zu bytes)",
-             cfg.host.c_str(), cfg.port, user_id.c_str(), token.size());
+    OBN_INFO("cloud mqtt: connecting to %s:%d as u_%s (token=%zu bytes, "
+             "tls_verify=%d)",
+             cfg.host.c_str(), cfg.port, user_id.c_str(), token.size(),
+             verify ? 1 : 0);
 
     int rc = client_->connect(cfg);
     if (rc != MOSQ_ERR_SUCCESS) {

src/lan_tls.cpp

@@ -274,7 +274,8 @@ void sync_registry_locked()
 void warn_skip_once()
 {
     if (g_skip_warn_logged.exchange(true)) return;
-    OBN_WARN("OBN_SKIP_TLS_VERIFY set — printer TLS verification disabled");
+    OBN_WARN("lan_tls_skip_verify / OBN_SKIP_TLS_VERIFY set — TLS verification "
+             "disabled for printer (LAN) and cloud MQTT connections");
 }
 
 } // namespace