Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(esp_http_server): Allow the https server to request client certs optionally

Browse Source 
Closes https://github.com/espressif/esp-idf/pull/17641
This commit is contained in:
0xFEEDC0DE64
2026-02-11 17:49:44 +08:00
committed by Ashish Sharma
parent 82e525ef3e
commit 2ed84eb04b
22 changed files with 428 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp-tls/Kconfig
+5 -4
View File
@@ -62,13 +62,14 @@ menu "ESP-TLS"
config ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
bool "ESP-TLS Server: Set minimum Certificate Verification mode to Optional"
depends on ESP_TLS_USING_MBEDTLS
default n
help
When this option is enabled, the peer (here, the client) certificate is checked by the server,
however the handshake continues even if verification failed. By default, the
peer certificate is not checked and ignored by the server.
When this option is enabled, the ESP-TLS server can be configured to
request client certificates optionally. This is done by setting the
client_cert_authmode_optional field in the esp_https_server_config_t structure.
mbedtls_ssl_get_verify_result() can be called after the handshake is complete to
retrieve status of verification.
retrieve status of verification of the client certificate, if presented.
config ESP_TLS_PSK_VERIFICATION
bool "Enable PSK verification"
components/esp-tls/esp_tls.h
+4
View File
@@ -296,6 +296,10 @@ typedef struct esp_tls_cfg_server {
unsigned int cacert_pem_bytes; /*!< Size of client CA certificate legacy name */
};
#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
bool client_cert_authmode_optional; /*!< Set client certificate authentication mode to optional.
By default, client certificate authentication mode is set to required */
#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
union {
const unsigned char *servercert_buf; /*!< Server certificate in a buffer
This buffer should be NULL terminated */
components/esp-tls/esp_tls_mbedtls.c
+4 -5
View File
@@ -757,12 +757,11 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls)
if (esp_ret != ESP_OK) {
return esp_ret;
}
} else {
#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
#else
mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_NONE);
#endif
if (cfg->client_cert_authmode_optional) {
mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
}
#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
}
if (cfg->use_secure_element) {
components/esp_https_server/include/esp_https_server.h
+16
View File
@@ -91,6 +91,11 @@ struct httpd_ssl_config {
/** CA certificate byte length */
size_t cacert_len;
#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
/** Client certificate authentication mode */
bool client_cert_authmode_optional;
#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
/** Private key */
const uint8_t *prvtkey_pem;
@@ -145,6 +150,16 @@ struct httpd_ssl_config {
typedef struct httpd_ssl_config httpd_ssl_config_t;
/**
* Helper macro for optional client certificate authentication field
*/
#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
#define HTTPD_SSL_CONFIG_CLIENT_AUTH_OPTIONAL_INIT \
.client_cert_authmode_optional = false,
#else
#define HTTPD_SSL_CONFIG_CLIENT_AUTH_OPTIONAL_INIT
#endif
/**
* Default config struct init
* Notes:
@@ -188,6 +203,7 @@ typedef struct httpd_ssl_config httpd_ssl_config_t;
.servercert_len = 0, \
.cacert_pem = NULL, \
.cacert_len = 0, \
HTTPD_SSL_CONFIG_CLIENT_AUTH_OPTIONAL_INIT \
.prvtkey_pem = NULL, \
.prvtkey_len = 0, \
.use_ecdsa_peripheral = false, \
components/esp_https_server/src/https_server.c
+3
View File
@@ -278,6 +278,9 @@ static esp_err_t create_secure_context(const struct httpd_ssl_config *config, ht
cfg->userdata = config->ssl_userdata;
cfg->alpn_protos = config->alpn_protos;
cfg->tls_handshake_timeout_ms = config->tls_handshake_timeout_ms;
#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
cfg->client_cert_authmode_optional = config->client_cert_authmode_optional;
#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
#if defined(CONFIG_ESP_HTTPS_SERVER_CERT_SELECT_HOOK)
cfg->cert_select_cb = config->cert_select_cb;