From 8100e2f13a0bad0fa8b72002a1b701c128c420ab Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Sun, 10 May 2026 17:44:20 +0530 Subject: [PATCH] fix(esp-tls): clarify skip_common_name and warn when SNI is disabled The skip_common_name flag was named for the legacy CN field but actually suppresses the entire mbedtls_ssl_set_hostname() call -- disabling hostname matching against CN/SAN AND Server Name Indication. Update the doxygen to describe the real effect, and emit a per-call WARN inside the SNI-disable branch so debug-only use does not slip into production unnoticed. --- components/esp-tls/esp_tls.h | 11 +++++++++-- components/esp-tls/esp_tls_mbedtls.c | 3 +++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/components/esp-tls/esp_tls.h b/components/esp-tls/esp_tls.h index 5c74191d432..8e3608aef81 100644 --- a/components/esp-tls/esp_tls.h +++ b/components/esp-tls/esp_tls.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -203,7 +203,14 @@ typedef struct esp_tls_cfg { const char *common_name; /*!< If non-NULL, server certificate CN must match this name. If NULL, server certificate CN must match hostname. */ - bool skip_common_name; /*!< Skip any validation of server certificate CN field */ + bool skip_common_name; /*!< When true, esp-tls skips the call to + mbedtls_ssl_set_hostname(). This disables BOTH + server-hostname matching against the certificate + (CN/SAN) and Server Name Indication (SNI), not just + the legacy CN field. Only set on loopback / debug + clients that can tolerate the loss of hostname + authentication. Must be false for SNI to function + correctly. */ tls_keep_alive_cfg_t *keep_alive_cfg; /*!< Enable TCP keep-alive timeout for SSL connection */ diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 8e03a566ca6..05b125d6e3b 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -896,6 +896,9 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t } free(use_host); } else { + ESP_LOGW(TAG, "skip_common_name=true: hostname matching and SNI disabled. " + "This disables ALL server-name authentication (CN/SAN/SNI), not just CN. " + "Only intended for loopback / debug clients."); mbedtls_ssl_set_hostname(&tls->ssl, NULL); }