espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-31 19:24:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(mbedtls): new config to allow weak cert verification

Browse Source
This commit is contained in:
Ashish Sharma
2025-03-28 15:46:48 +08:00
parent 45bf1239d6
commit ededcccda5
3 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/esp-tls/esp_tls_mbedtls.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -294,7 +294,7 @@ ssize_t esp_mbedtls_write(esp_tls_t *tls, const char *data, size_t datalen)
return ret;
} else {
// Exiting the tls-write process as less than desired datalen are writable
ESP_LOGD(TAG, "mbedtls_ssl_write() returned -0x%04zX, already written %zu, exitting...", -ret, written);
ESP_LOGD(TAG, "mbedtls_ssl_write() returned -0x%04zX, already written %zu, exiting...", -ret, written);
mbedtls_print_error_msg(ret);
return (written > 0) ? written : ret;
}

7
components/mbedtls/Kconfig
View File

@@ -1230,4 +1230,11 @@ menu "mbedTLS"
which is added through vfs component for ESP32 based targets or by
the host system when the target is Linux.
config MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION
bool "Allow weak certificate verification"
default n
help
This options allows weak certificate verification by skipping the hostname verification.
It is not recommended to use this option.
endmenu # mbedTLS

15
components/mbedtls/port/include/mbedtls/esp_config.h
View File

@@ -2088,6 +2088,21 @@
#undef MBEDTLS_ERROR_C
#endif
/**
* \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
*
* Caller: library/ssl_tls.c
*
* Allow weak certificate verification without a hostname.
* This option is not recommended for production use.
*/
#if CONFIG_MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION
#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
#else
#undef MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME
#endif
/**
* \def MBEDTLS_GCM_C
*