fix: validate device cert chain against OCF root CA instead of VERIFY_NONE

protocol/dtls_session.py

@@ -22,6 +22,7 @@ import os
 import socket
 import threading
 import time
+from pathlib import Path
 
 from OpenSSL import SSL
 
@@ -37,6 +38,8 @@ import logging
 
 logger = logging.getLogger(__name__)
 
+_OCF_ROOT_CA = str(Path(__file__).parent / 'ocf_root_ca.pem')
+
 
 # Diagnostic logging — when DEBUG_BRIDGE=1 in env, the bridge dumps
 # every received CoAP frame, every /operational/state/vs/0 + /oven/vs/0
@@ -102,9 +105,13 @@ class DtlsCoapSession:
         """DTLS handshake. Blocks up to HANDSHAKE_TIMEOUT_S. Raises
         ConnectionError / TimeoutError on failure."""
         ctx = SSL.Context(SSL.DTLS_METHOD)
-        ctx.set_verify(SSL.VERIFY_NONE, lambda *_: True)
-        # @SECLEVEL=0 — the AC14K_M-rooted chain is SHA-1 signed, which
-        # OpenSSL 3.x's default security level rejects.
+
+        ctx.load_verify_locations(_OCF_ROOT_CA)
+        ctx.set_verify(SSL.VERIFY_PEER, lambda conn, cert, err, depth, ok: ok)
+        # @SECLEVEL=0 permits SHA-1 in Samsung's server cert chain (AC14K_M
+        # intermediate is SHA-1 signed). This is the only channel that reaches
+        # the OpenSSL instance cryptography bundles — ctypes and cffi bindings
+        # do not expose SSL_CTX_set_security_level on this build.
         ctx.set_cipher_list(b'ECDHE-ECDSA-AES128-GCM-SHA256:@SECLEVEL=0')
         ctx.use_certificate_chain_file(self.cert_path)
         ctx.use_privatekey_file(self.key_path)