espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-31 19:24:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(mbedtls): new config to allow weak cert verification

Browse Source
This commit is contained in:
Ashish Sharma
2025-03-28 15:46:48 +08:00
parent 45bf1239d6
commit ededcccda5
3 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/esp-tls/esp_tls_mbedtls.c
View File

@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -294,7 +294,7 @@ ssize_t esp_mbedtls_write(esp_tls_t *tls, const char *data, size_t datalen)
return ret; return ret;
} else { } else {
// Exiting the tls-write process as less than desired datalen are writable // Exiting the tls-write process as less than desired datalen are writable
ESP_LOGD(TAG, "mbedtls_ssl_write() returned -0x%04zX, already written %zu, exitting...", -ret, written); ESP_LOGD(TAG, "mbedtls_ssl_write() returned -0x%04zX, already written %zu, exiting...", -ret, written);
mbedtls_print_error_msg(ret); mbedtls_print_error_msg(ret);
return (written > 0) ? written : ret; return (written > 0) ? written : ret;
} }

7
components/mbedtls/Kconfig
View File

@@ -1230,4 +1230,11 @@ menu "mbedTLS"
which is added through vfs component for ESP32 based targets or by which is added through vfs component for ESP32 based targets or by
the host system when the target is Linux. the host system when the target is Linux.
config MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION
bool "Allow weak certificate verification"
default n
help
This options allows weak certificate verification by skipping the hostname verification.
It is not recommended to use this option.
endmenu # mbedTLS endmenu # mbedTLS

15
components/mbedtls/port/include/mbedtls/esp_config.h
View File

@@ -2088,6 +2088,21 @@
#undef MBEDTLS_ERROR_C #undef MBEDTLS_ERROR_C
#endif #endif
/**
* \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
*
* Caller: library/ssl_tls.c
*
* Allow weak certificate verification without a hostname.
* This option is not recommended for production use.
*/
#if CONFIG_MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION
#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
#else
#undef MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
#endif
/** /**
* \def MBEDTLS_GCM_C * \def MBEDTLS_GCM_C
* *