From 232685bae9c0b1c3bf00d88d03384e39a5e771ff Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Sat, 4 Apr 2026 10:23:00 +0530 Subject: [PATCH 1/2] fix(esp-tls): close CA-verification bypass during session resumption The session-resumption else-if in set_client_config() short-circuited the CA verification chain when only client_session was supplied. Remove the branch so session-only configs fall through to the normal error / skip-verify path; resumption no longer silently disables CA validation. --- components/esp-tls/esp_tls_mbedtls.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 37a22b5fa42..9f64bb24622 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -813,10 +813,6 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t #else ESP_LOGE(TAG, "psk_hint_key configured but not enabled in menuconfig: Please enable ESP_TLS_PSK_VERIFICATION option"); return ESP_ERR_INVALID_STATE; -#endif -#ifdef CONFIG_ESP_TLS_CLIENT_SESSION_TICKETS - } else if (cfg->client_session != NULL) { - ESP_LOGD(TAG, "Resuing the saved client session"); #endif } else { #ifdef CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY From db1d27c5f5fd89aea031abe6090854fc56d6180c Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Sun, 10 May 2026 17:44:20 +0530 Subject: [PATCH 2/2] fix(esp-tls): clarify skip_common_name and warn when SNI is disabled The skip_common_name flag was named for the legacy CN field but actually suppresses the entire mbedtls_ssl_set_hostname() call -- disabling hostname matching against CN/SAN AND Server Name Indication. Update the doxygen to describe the real effect, and emit a per-call WARN inside the SNI-disable branch so debug-only use does not slip into production unnoticed. --- components/esp-tls/esp_tls.h | 11 +++++++++-- components/esp-tls/esp_tls_mbedtls.c | 3 +++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/components/esp-tls/esp_tls.h b/components/esp-tls/esp_tls.h index 1d46b62e74d..ed28cc70ddc 100644 --- a/components/esp-tls/esp_tls.h +++ b/components/esp-tls/esp_tls.h @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2017-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -189,7 +189,14 @@ typedef struct esp_tls_cfg { const char *common_name; /*!< If non-NULL, server certificate CN must match this name. If NULL, server certificate CN must match hostname. */ - bool skip_common_name; /*!< Skip any validation of server certificate CN field */ + bool skip_common_name; /*!< When true, esp-tls skips the call to + mbedtls_ssl_set_hostname(). This disables BOTH + server-hostname matching against the certificate + (CN/SAN) and Server Name Indication (SNI), not just + the legacy CN field. Only set on loopback / debug + clients that can tolerate the loss of hostname + authentication. Must be false for SNI to function + correctly. */ tls_keep_alive_cfg_t *keep_alive_cfg; /*!< Enable TCP keep-alive timeout for SSL connection */ diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 9f64bb24622..fdf40f96007 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -739,6 +739,9 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t } free(use_host); } else { + ESP_LOGW(TAG, "skip_common_name=true: hostname matching and SNI disabled. " + "This disables ALL server-name authentication (CN/SAN/SNI), not just CN. " + "Only intended for loopback / debug clients."); mbedtls_ssl_set_hostname(&tls->ssl, NULL); }