From c5f20937bdf895e8de7d6b4c9ddffbdd2632e72e Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Sat, 4 Apr 2026 10:23:00 +0530 Subject: [PATCH] fix(esp-tls): close CA-verification bypass during session resumption The session-resumption else-if in set_client_config() short-circuited the CA verification chain when only client_session was supplied. Remove the branch so session-only configs fall through to the normal error / skip-verify path; resumption no longer silently disables CA validation. --- components/esp-tls/esp_tls_mbedtls.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 1afdcb13bbb..393c28d92b2 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -1003,10 +1003,6 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_SSL_CONF_PSK_FAILED; } -#endif -#ifdef CONFIG_ESP_TLS_CLIENT_SESSION_TICKETS - } else if (cfg->client_session != NULL) { - ESP_LOGD(TAG, "Reusing the saved client session"); #endif } else { #ifdef CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY