From 15ac4697f3482ffca8a92ac3888bbe05c78f1e5e Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Sat, 4 Apr 2026 10:23:00 +0530 Subject: [PATCH 1/2] fix(esp-tls): close CA-verification bypass during session resumption The session-resumption else-if in set_client_config() short-circuited the CA verification chain when only client_session was supplied. Remove the branch so session-only configs fall through to the normal error / skip-verify path; resumption no longer silently disables CA validation. --- components/esp-tls/esp_tls_mbedtls.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 1afdcb13bbb..393c28d92b2 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -1003,10 +1003,6 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_SSL_CONF_PSK_FAILED; } -#endif -#ifdef CONFIG_ESP_TLS_CLIENT_SESSION_TICKETS - } else if (cfg->client_session != NULL) { - ESP_LOGD(TAG, "Reusing the saved client session"); #endif } else { #ifdef CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY From 0004544536f8d878114d3be40d64f362f5c98aef Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Sun, 10 May 2026 17:44:20 +0530 Subject: [PATCH 2/2] fix(esp-tls): clarify skip_common_name and warn when SNI is disabled The skip_common_name flag was named for the legacy CN field but actually suppresses the entire mbedtls_ssl_set_hostname() call -- disabling hostname matching against CN/SAN AND Server Name Indication. Update the doxygen to describe the real effect, and emit a per-call WARN inside the SNI-disable branch so debug-only use does not slip into production unnoticed. --- components/esp-tls/esp_tls.h | 12 +++++++++--- components/esp-tls/esp_tls_mbedtls.c | 3 +++ 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/components/esp-tls/esp_tls.h b/components/esp-tls/esp_tls.h index 324007126d2..c7802b94185 100644 --- a/components/esp-tls/esp_tls.h +++ b/components/esp-tls/esp_tls.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -198,8 +198,14 @@ typedef struct esp_tls_cfg { const char *common_name; /*!< If non-NULL, server certificate CN must match this name. If NULL, server certificate CN must match hostname. */ - bool skip_common_name; /*!< Skip any validation of server certificate CN field. - This field should be set to false for SNI to function correctly. */ + bool skip_common_name; /*!< When true, esp-tls skips the call to + mbedtls_ssl_set_hostname(). This disables BOTH + server-hostname matching against the certificate + (CN/SAN) and Server Name Indication (SNI), not just + the legacy CN field. Only set on loopback / debug + clients that can tolerate the loss of hostname + authentication. Must be false for SNI to function + correctly. */ tls_keep_alive_cfg_t *keep_alive_cfg; /*!< Enable TCP keep-alive timeout for SSL connection */ diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 393c28d92b2..ebcfba4cf11 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -931,6 +931,9 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t } free(use_host); } else { + ESP_LOGW(TAG, "skip_common_name=true: hostname matching and SNI disabled. " + "This disables ALL server-name authentication (CN/SAN/SNI), not just CN. " + "Only intended for loopback / debug clients."); mbedtls_ssl_set_hostname(&tls->ssl, NULL); }