diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig index f97f2c1bcb4..2fc7f968f1f 100644 --- a/components/mbedtls/Kconfig +++ b/components/mbedtls/Kconfig @@ -545,14 +545,17 @@ menu "mbedTLS" config MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY bool "Support cross-signed certificate verification in certificate bundle" - default n + default y depends on MBEDTLS_CERTIFICATE_BUNDLE select MBEDTLS_X509_TRUSTED_CERT_CALLBACK help Enable support for cross-signed certificate verification in the certificate bundle. This feature uses an internal callback to verify the cross-signed certificates. - This feature is kept disabled by default as enabling this feature increases - heap usage by approximately 700 bytes. + + Enabling this feature increases peak heap usage during the TLS handshake by + approximately 1 KB. This is a transient allocation (a candidate CA certificate + built during certificate verification) that is freed once the handshake completes, + and the exact amount scales with the maximum supported RSA key size. endmenu config MBEDTLS_TLS_ENABLED diff --git a/docs/en/api-reference/protocols/esp_crt_bundle.rst b/docs/en/api-reference/protocols/esp_crt_bundle.rst index 5851d5e8f88..287a408d769 100644 --- a/docs/en/api-reference/protocols/esp_crt_bundle.rst +++ b/docs/en/api-reference/protocols/esp_crt_bundle.rst @@ -91,7 +91,7 @@ With this functionality enabled, certificate verification is performed in a mann .. note:: - Enabling cross-signed certificate support increases run-time heap utilization by approximately 700 bytes, but reduces the flash footprint as the bundle size is reduced. + Enabling cross-signed certificate support increases peak run-time heap usage during the TLS handshake by approximately 1 KB. This is a transient allocation (a candidate CA certificate built during certificate verification) that is freed once the handshake completes, and the exact amount scales with the maximum supported RSA key size. It also reduces the flash footprint, as the bundle size is reduced. Key Points: diff --git a/docs/en/api-reference/protocols/mbedtls.rst b/docs/en/api-reference/protocols/mbedtls.rst index 44ebdff9ead..5d576599dc6 100644 --- a/docs/en/api-reference/protocols/mbedtls.rst +++ b/docs/en/api-reference/protocols/mbedtls.rst @@ -406,6 +406,10 @@ The following table shows typical memory usage with different configs when the : These values are subject to change with changes in configuration options and versions of Mbed TLS. +.. note:: + + :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` is enabled by default. If cross-signed certificate chains are not required, disabling it reduces peak heap usage during the TLS handshake by approximately 1 KB, at the cost of a larger certificate bundle in flash. See :doc:`/api-reference/protocols/esp_crt_bundle` for details. + Reducing Binary Size ^^^^^^^^^^^^^^^^^^^^ diff --git a/docs/zh_CN/api-reference/protocols/esp_crt_bundle.rst b/docs/zh_CN/api-reference/protocols/esp_crt_bundle.rst index 6c43c9ee4a5..340bac47875 100644 --- a/docs/zh_CN/api-reference/protocols/esp_crt_bundle.rst +++ b/docs/zh_CN/api-reference/protocols/esp_crt_bundle.rst @@ -91,7 +91,7 @@ ESP x509 证书包 API 提供了一种简便的方法，帮助你安装自定义 .. note:: - 启用交叉签名证书支持功能后，运行时的堆内存使用量将增加约 700 字节，但由于证书包体积减小，flash 占用会降低。 + 启用交叉签名证书支持功能后，TLS 握手期间的运行时堆内存峰值将增加约 1 KB。该内存为临时分配（证书验证期间构建的候选 CA 证书），握手完成后即被释放，其具体大小与支持的最大 RSA 密钥长度相关。此外，由于证书包体积减小，flash 占用也会降低。 关键点： diff --git a/docs/zh_CN/api-reference/protocols/mbedtls.rst b/docs/zh_CN/api-reference/protocols/mbedtls.rst index 500235fea39..74c0157cd1a 100644 --- a/docs/zh_CN/api-reference/protocols/mbedtls.rst +++ b/docs/zh_CN/api-reference/protocols/mbedtls.rst @@ -406,6 +406,10 @@ Mbed TLS 配置系统支持预设配置。``Component Config`` > ``mbedTLS`` 中 这些值会随着配置选项和 Mbed TLS 版本的变化而变化。 +.. note:: + + :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` 默认启用。如果无需支持交叉签名证书链，禁用该选项可将 TLS 握手期间的堆内存峰值降低约 1 KB，但代价是 flash 中的证书包体积会增大。详情请参阅 :doc:`/api-reference/protocols/esp_crt_bundle`。 + 减小固件大小 ^^^^^^^^^^^^^^^^^^