feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

mbedtls: Add config option key element and key element ext

Browse Source
This commit is contained in:
Kapil Gupta
2021-03-25 09:36:26 +05:30
parent 8694cb7fdf
commit 38d6772507
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
components/mbedtls/Kconfig
View File

@ -561,6 +561,22 @@ menu "mbedTLS"
Client support for RFC 5077 session tickets. See mbedTLS documentation for more details.
Disabling this option will save some code size.
config MBEDTLS_X509_CHECK_KEY_USAGE
bool "Enable verification of the keyUsage extension"
default y
depends on MBEDTLS_TLS_ENABLED
help
Disabling this avoids problems with mis-issued and/or misused (intermediate) CA and leaf certificates.
Depending on your PKI use, disabling this can be a security risk.
config MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
bool "Enable verification of the extendedKeyUsage extension"
default y
depends on MBEDTLS_TLS_ENABLED
help
Disabling this avoids problems with mis-issued and/or misused certificates.
Depending on your PKI use, disabling this can be a security risk.
config MBEDTLS_SERVER_SSL_SESSION_TICKETS
bool "TLS: Server Support for RFC 5077 SSL session tickets"
default y

8
components/mbedtls/port/include/mbedtls/esp_config.h
View File

@ -1193,7 +1193,11 @@
*
* Comment to skip keyUsage checking for both CA and leaf certificates.
*/
#ifdef CONFIG_MBEDTLS_X509_CHECK_KEY_USAGE
#define MBEDTLS_X509_CHECK_KEY_USAGE
#else
#undef MBEDTLS_X509_CHECK_KEY_USAGE
#endif
/**
* \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
@ -1206,7 +1210,11 @@
*
* Comment to skip extendedKeyUsage checking for certificates.
*/
#ifdef CONFIG_MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
#else
#undef MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
#endif
/**
* \def MBEDTLS_X509_RSASSA_PSS_SUPPORT