diff --git a/include/mqtt_client.h b/include/mqtt_client.h index aa2b1ec..11402b3 100644 --- a/include/mqtt_client.h +++ b/include/mqtt_client.h @@ -259,6 +259,7 @@ typedef struct esp_mqtt_client_config_t { verify broker.*/ bool skip_cert_common_name_check; /*!< Skip any validation of server certificate CN field, this reduces the security of TLS and makes the *MQTT* client susceptible to MITM attacks */ + bool skip_server_verification; /*!< Skip server verification completely. Should only be used for debugging */ const char **alpn_protos; /*!< NULL-terminated list of supported application protocols to be used for ALPN */ } verification; /*!< Security verification of the broker */ } broker; /*!< Broker address and security verification */ diff --git a/lib/include/mqtt_client_priv.h b/lib/include/mqtt_client_priv.h index e359420..6e370bb 100644 --- a/lib/include/mqtt_client_priv.h +++ b/lib/include/mqtt_client_priv.h @@ -89,6 +89,7 @@ typedef struct { size_t clientkey_bytes; const struct psk_key_hint *psk_hint_key; bool skip_cert_common_name_check; + bool skip_server_verification; bool use_secure_element; void *ds_data; int message_retransmit_timeout; diff --git a/mqtt_client.c b/mqtt_client.c index 3a2563c..56ba30d 100644 --- a/mqtt_client.c +++ b/mqtt_client.c @@ -126,6 +126,8 @@ static esp_err_t esp_mqtt_set_ssl_transport_properties(esp_transport_list_handle if (cfg->use_global_ca_store == true) { esp_transport_ssl_enable_global_ca_store(ssl); + } else if (cfg->skip_server_verification == true) { + esp_transport_ssl_skip_server_verification(ssl); } else if (cfg->crt_bundle_attach != NULL) { #ifdef MQTT_SUPPORTED_FEATURE_CERTIFICATE_BUNDLE #ifdef CONFIG_MBEDTLS_CERTIFICATE_BUNDLE @@ -509,6 +511,7 @@ esp_err_t esp_mqtt_set_config(esp_mqtt_client_handle_t client, const esp_mqtt_cl client->config->clientkey_buf = config->credentials.authentication.key; client->config->clientkey_bytes = config->credentials.authentication.key_len; client->config->skip_cert_common_name_check = config->broker.verification.skip_cert_common_name_check; + client->config->skip_server_verification = config->broker.verification.skip_server_verification; client->config->use_secure_element = config->credentials.authentication.use_secure_element; client->config->ds_data = config->credentials.authentication.ds_data;