espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-30 18:57:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(mbedtls): new config to allow weak cert verification

Browse Source
This commit is contained in:
Ashish Sharma
2025-03-28 15:46:48 +08:00
parent 7578913742
commit 605206b69f
3 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/esp-tls/esp_tls_mbedtls.c
View File

@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@ -791,7 +791,7 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t
#endif
#ifdef CONFIG_ESP_TLS_CLIENT_SESSION_TICKETS
} else if (cfg->client_session != NULL) {
ESP_LOGD(TAG, "Resuing the saved client session");
ESP_LOGD(TAG, "Reusing the saved client session");
#endif
} else {
#ifdef CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY

7
components/mbedtls/Kconfig
View File

@ -1262,4 +1262,11 @@ menu "mbedTLS"
which is added through vfs component for ESP32 based targets or by
the host system when the target is Linux.
config MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION
bool "Allow weak certificate verification"
default n
help
This options allows weak certificate verification by skipping the hostname verification.
It is not recommended to use this option.
endmenu # mbedTLS

15
components/mbedtls/port/include/mbedtls/esp_config.h
View File

@ -2117,6 +2117,21 @@
#undef MBEDTLS_ERROR_C
#endif
/**
* \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
*
* Caller: library/ssl_tls.c
*
* Allow weak certificate verification without a hostname.
* This option is not recommended for production use.
*/
#if CONFIG_MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION
#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
#else
#undef MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
#endif
/**
* \def MBEDTLS_GCM_C
*