matter-server fetches PAA root certificates, vendor names and OTA
metadata from the CSA DCL (on.dcl.csa-iot.org) and the development PAA
certificates from project-chip on GitHub (python-matter-server
helpers/paa_certificates.py, vendor_info.py, ota/dcl.py). zigbee2mqtt
fetches the Koenkk/zigbee-OTA index and images from
raw.githubusercontent.com (zigbee-herdsman ota.ts). The namespace
baseline denied all of it (~350 and ~200 drops a day), so certificate
refresh, vendor names and OTA silently failed. FQDN-scoped, 443 only.
S28-42
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>