fix(ssl): retain loaded certificate authorities

[eliasbruno124-dev]

What

The Last of Us Part II Remastered (PPSA15508/01.002.000) stops at sceSslLoadCert during startup. This change parses and retains the supplied CA chain and optional client credentials per SSL context, exposes owned DER snapshots, and releases allocations on unload/free/term. Invalid imports leave existing credentials intact. Loading credentials does not establish a TLS connection or authenticate a peer; unsupported operations still throw.

Adopts the maintainer's exact rebased commit b737308e, directly on the final #5226 commit 8e688966, now merged into main. The shared registry and certificate/connection lifetime regression are retained. sceSslConnect, sceSslRead and sceSslWrite remain explicit NotImplemented_nid_no_patch stubs; this PR adds no TLS transport. SSL and pool-stat debt stays in the matching library files; TechnicalDebt.md is unchanged from the parent.

Dependency

Mbed TLS 3.6.7 is pinned as a source submodule for X.509 DER/PEM parsing and client certificate/private-key matching. Main has no existing certificate parser; its media dependencies do not provide these operations. The link uses mbedx509, mbedcrypto and p256m, without Everest or the Mbed TLS transport library.

The linked Mbed TLS and p256-m sources offer Apache-2.0 OR GPL-2.0-or-later; the Apache-2.0 option is available here, and upstream license files are retained. The pinned Mbed TLS/framework revisions contain 47,433,926 tracked source bytes, excluding Git history, generated files and build outputs. In the earlier October 14 Windows Release comparison, the patched, unstripped SSL DLL grows from 79,106 bytes with #5226 alone to 720,093 bytes with certificate support (+640,987). This historical measurement covers the whole certificate contribution; it is not a fresh size comparison of the maintainer's rebase.

Tested

Windows 11, WinLibs GCC 15.2.0, Release, exact b737308e:

• All runtime libraries and the relinker build. Seven focused tests pass: guest_ssl_load, guest_ssl, guest_http, guest_http2, guest_http_response_header, guest_memory_pool_stats and guest_sce_net, with a 30-second per-test limit.
• The earlier matched negative control passes the connection test but fails the certificate regression at sceSslLoadCert not implemented; restoring the certificate implementation passes all seven. That control predates this rebase. The certificate regression and its fixtures are unchanged; all seven tests were rerun on b737308e.
• Coverage includes owned input, DER round-trip, context isolation, failed-import rollback, small-pool failure, snapshot release, client-key matching, concurrent contexts and certificate/connection lifetime interaction.
• Conventions and git diff --check pass. Linux was not tested locally.

The same-input TLOU comparison used main 0b6d033b8 plus #5226, changing only the SSL DLL. Baseline aborts at sceSslLoadCert. Candidate 3c96928e4 returns 0 for the same original 1,408-byte CA; the merged #3925 then completes HTTP2 send/wait with the offline result 0x80436063. The next stop is a null read at original VA 0x1b60f2, before VideoOutOpen or any submitted frame. The certificate code and its fixtures remain unchanged by the maintainer's latest rebase; its SSL changes preserve the final parent's explicit transport stubs. The runtime and focused tests were rebuilt on b737308e, but this title observation remains attributed to 3c96928e4; it was not rerun on b737308e.

The original title files were preserved, using recorded plain-SELF staging and same-name resource mappings outside the dump. This is not a container-identical direct-dump launch or a menu, gameplay or performance result. Bring-up: #5468.

Console error precedence, repeated-import behavior, snapshot lifetime and exact allocator overhead remain unmeasured and are documented as technical debt.

Checklist

• Based on the maintainer's requested parent, now in main; no other open PR implements the same certificate operations
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw; no silent stubs added
• No notes, investigation files or images added to the repository
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none (feat(libSceSsl): add the connection calls #5226 is merged; this commit uses its final version)
• Unblocks: PPSA15508 The Last of Us Part II Remastered (PPSA15508) #5468 (certificate import; not full playability)
• GPUs tested: n/a (SSL library correction)
• AI-assisted: yes

[github-actions]

Progress report (23e93c0 → b737308)

📈 System libraries: 88.33% (+0.03%, +1 implemented functions)

✅ 1 implemented

Library	Name
libSceSsl	sceSslLoadCert

[adriadam10]

Thanks for this. Not mergeable as is:

• The branch is based on an old main and conflicts in docs/dev/TechnicalDebt.md. Main has since split that page: entries about one library now live in docs/dev/debt/<library>.md under the same sections. The diff rewrites the old single file and would revert that split. Please rebase on current main and put the libSceSsl lines in the matching debt/ file, leaving TechnicalDebt.md as on main. I can't push the rebase myself because "Allow edits from maintainers" is off on the PR.
• This adds 3rdparty/mbedtls as a new third-party dependency (new submodule, new CMake wiring). Please mention in the PR body why an existing dependency isn't enough and its license/size impact, so the maintainers can OK it.

After the rebase, please rerun guest_ssl_load and the other focused tests on the rebased head.

[eliasbruno124-dev]

Rebased in f76d8c6 onto 0aa4cb1. The SSL and shared pool-stat debt entries are in the matching library files; TechnicalDebt.md is unchanged from main, and newer throwing exports are preserved.

The full Windows Release build, libs and all six focused tests pass on the rebased head. The certificate-load regression fails with main's Export.cpp and passes after restoring the implementation; the final rebase changes neither side. Conventions, including the updated PR body, and diff checks pass. Linux was not tested locally.

The description now explains why a certificate parser is needed, the Mbed TLS/p256-m license options and the measured size impact: 47,433,926 tracked source bytes including the framework, and +640,288 bytes for the complete unstripped Windows SSL binary. The actual link excludes Everest and the TLS transport library. TLOU's current startup observation is in #5468; it is not yet rendering.

#5226 separately changes the SSL context registry for connection operations. Do you prefer that to land first? I can rebase this certificate work over it; it is not included in this branch.

Maintainer edits remain disabled at the owner's request; I will handle any further corrections here.

Prepared with AI assistance.

[MarcZX10]

I recommend integrating #5226 before this certificate change, then rebasing this PR onto it. There is no behavioral dependency for sceSslLoadCert, but both changes edit libSceSsl/Export.cpp and its CMake/test wiring. #5226 adds connection state and socket calls; this PR replaces the SSL implementation and should preserve those additions when the two are combined. After that rebase, the six focused tests and the title evidence should be rerun on the integrated head.

[eliasbruno124-dev]

Integrated #5226 first, preserving its authors and connection/socket behavior, then rebased the certificate change onto main 9013e89b1 in 8bd213cb5. Depends on: #5226 is now explicit. The shared registry and a new interaction regression cover certificate loads alongside live connections, separate contexts and termination.

The full Windows runtime/relinker build and all seven focused tests pass. With the parent-only SSL implementation, the connection test passes but the certificate regression fails at the original missing operation; restoring the candidate passes again. The final rebase preserves that implementation byte-for-byte. Conventions and diff checks pass; Linux remains untested locally.

The same-input TLOU comparison on 0b6d033b8 + #5226 changes only SSL: baseline aborts at sceSslLoadCert; the integrated candidate returns 0 for the same 1,408-byte CA. With #3925 now in main, HTTP2 send/wait complete with the offline result, then execution stops at a null read at original VA 0x1b60f2, before the first frame. The description records the exact tested commit, dependency/size details and preprocessing limits. This proves the certificate fix survives the integration, not gameplay.

Prepared with AI assistance.

[oneandonlydean]

@eliasbruno124-dev #5226 goes in first, and this branch carries older copies of its two commits, so I rebased your certificate commit onto #5226's final version: oneandonlydean/AnyPS5@b737308 (branch ssl3897-on5226). Connect, read and write stay NotImplemented_nid_no_patch stubs and your registry is kept; guest_ssl and guest_ssl_load pass on Linux. Your branch doesn't allow maintainer edits, so could you reset it to that commit? It merges once #5226 is in and the full build is green.

Met: rebased onto main, debt lines moved to debt/, dependency and license explained, focused tests rerun.

[eliasbruno124-dev]

Adopted your exact b737308eedd87e601905fe923b52698a49520557 on this branch. #5226 is now merged; connect/read/write keep its explicit NotImplemented_nid_no_patch stubs, and the certificate registry and lifetime regression are unchanged.

The complete Windows runtime, relinker and relevant test executables build. All seven focused SSL/HTTP/Net tests pass with the 30-second limit; conventions and diff checks pass. Linux was not run locally. The description keeps the earlier TLOU comparison tied to its measured commit rather than claiming a new title run.

Prepared with AI assistance.

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
#1835	.gitmodules L39
#5676	docs/dev/debt/libSceNet.md L5-6