Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'docs/update_esp_crt_bundle_cn' into 'master'

Browse Source 
docs: Update the CN translation for esp_crt_bundle.rst

Closes DOC-11550

See merge request espressif/esp-idf!40527
This commit is contained in:
Shen Meng Jing
2025-07-16 12:19:56 +08:00
parent cd945b22de 8f5e74ee86
commit c55e913b8d
2 changed files with 38 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/en/api-reference/protocols/esp_crt_bundle.rst
View File

@@ -87,19 +87,18 @@ Cross-Signed Certificate Support
Overview
^^^^^^^^
When the configuration option :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` is enabled,
the ESP x509 Certificate Bundle API adds support for verifying certificate chains that include cross-signed root certificates.
This feature allows the verification process to dynamically select candidate Certificate Authorities (CAs) from the bundle,
even when the certificate chain contains cross-signed roots, improving interoperability with a wider range of server certificates.
When the configuration option :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` is enabled, the ESP x509 Certificate Bundle API adds support for verifying certificate chains that include cross-signed root certificates.
With this functionality enabled, certificate verification is performed in a manner equivalent to the default mbedTLS behaviour,
ensuring compatibility and robust validation for cross-signed chains.
This feature allows the verification process to dynamically select candidate Certificate Authorities (CAs) from the bundle, even when the certificate chain contains cross-signed roots, improving interoperability with a wider range of server certificates.
With this functionality enabled, certificate verification is performed in a manner equivalent to the default mbedTLS behavior, ensuring compatibility and robust validation for cross-signed chains.
.. note::
Enabling cross-signed certificate support increases run-time heap utilisation by approximately 700 bytes, but reduces the flash footprint as the bundle size is reduced.
Enabling cross-signed certificate support increases run-time heap utilization by approximately 700 bytes, but reduces the flash footprint as the bundle size is reduced.
Key Points:
- The bundle can act as a dynamic CA store, providing candidate root certificates during the handshake.
- The verification callback uses the issuer information from the certificate chain to locate and provide matching root certificates from the bundle.
- This is especially useful for environments where cross-signing is common, such as during root CA transitions.
@@ -107,8 +106,7 @@ Key Points:
Usage
^^^^^
No additional application changes are required beyond enabling :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` in your project configuration.
The bundle will automatically provide candidate CAs during the TLS handshake.
No additional application changes are required beyond enabling :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` in your project configuration. The bundle will automatically provide candidate CAs during the TLS handshake.
.. note::