From 8fbfc7fc5fbdf5edc791b4bb3209aaee6ac340dc Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Wed, 9 Sep 2026 15:43:40 +0800 Subject: [PATCH] fix(esp-tls): report certificate flags when the handshake fails --- components/esp-tls/esp_tls_mbedtls.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index cd839b8cb52..aeabfeab879 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -301,11 +301,22 @@ int esp_mbedtls_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg) ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_MBEDTLS_SSL_HANDSHAKE_FAILED); if (cfg->crt_bundle_attach != NULL || cfg->cacert_buf != NULL || cfg->use_global_ca_store == true) { - if (mbedtls_ssl_get_peer_cert(&tls->ssl) != NULL) { - /* This is to check whether handshake failed due to invalid certificate*/ + /* Check whether the handshake failed because of an invalid certificate. + * Three values are not certificate failures: + * - 0xFFFFFFFF is the initial value of verify_result. mbedTLS sets it in + * mbedtls_ssl_session_init() to mark the result as not available, and also + * returns it when the session context is absent. + * - 0 means that the peer certificate passed verification, and that the + * handshake failed for a different reason. + * - MBEDTLS_X509_BADCERT_SKIP_VERIFY means that mbedTLS did not verify a + * certificate at all. A TLS 1.3 handshake that resumes a session uses a + * PSK key exchange, and mbedTLS marks the result as skipped. */ + uint32_t verify_result = mbedtls_ssl_get_verify_result(&tls->ssl); + if (verify_result != 0 && verify_result != 0xFFFFFFFF + && verify_result != MBEDTLS_X509_BADCERT_SKIP_VERIFY) { esp_mbedtls_verify_certificate(tls); } else { - ESP_LOGD(TAG, "Skipping certificate verification - no peer certificate received"); + ESP_LOGD(TAG, "Skipping certificate verification - handshake did not fail on the peer certificate"); } } tls->conn_state = ESP_TLS_FAIL;