Merge branch 'feat/enable_cross_signed_cert_suppport_default_v6.0' into 'release/v6.0'

feat(mbedtls): enable cross signed certificate verification support by default (v6.0)

See merge request espressif/esp-idf!50535

components/mbedtls/Kconfig

@@ -545,14 +545,17 @@ menu "mbedTLS"
 
         config MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY
             bool "Support cross-signed certificate verification in certificate bundle"
-            default n
+            default y
             depends on MBEDTLS_CERTIFICATE_BUNDLE
             select MBEDTLS_X509_TRUSTED_CERT_CALLBACK
             help
                 Enable support for cross-signed certificate verification in the certificate bundle.
                 This feature uses an internal callback to verify the cross-signed certificates.
-                This feature is kept disabled by default as enabling this feature increases
-                heap usage by approximately 700 bytes.
+
+                Enabling this feature increases peak heap usage during the TLS handshake by
+                approximately 1 KB. This is a transient allocation (a candidate CA certificate
+                built during certificate verification) that is freed once the handshake completes,
+                and the exact amount scales with the maximum supported RSA key size.
     endmenu
 
     config MBEDTLS_TLS_ENABLED

docs/en/api-reference/protocols/esp_crt_bundle.rst

@@ -91,7 +91,7 @@ With this functionality enabled, certificate verification is performed in a mann
 
 .. note::
 
-    Enabling cross-signed certificate support increases run-time heap utilization by approximately 700 bytes, but reduces the flash footprint as the bundle size is reduced.
+    Enabling cross-signed certificate support increases peak run-time heap usage during the TLS handshake by approximately 1 KB. This is a transient allocation (a candidate CA certificate built during certificate verification) that is freed once the handshake completes, and the exact amount scales with the maximum supported RSA key size. It also reduces the flash footprint, as the bundle size is reduced.
 
 Key Points:
 

docs/en/api-reference/protocols/mbedtls.rst

@@ -404,6 +404,10 @@ The following table shows typical memory usage with different configs when the :
 
     These values are subject to change with changes in configuration options and versions of Mbed TLS.
 
+.. note::
+
+    :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` is enabled by default. If cross-signed certificate chains are not required, disabling it reduces peak heap usage during the TLS handshake by approximately 1 KB, at the cost of a larger certificate bundle in flash. See :doc:`/api-reference/protocols/esp_crt_bundle` for details.
+
 
 Reducing Binary Size
 ^^^^^^^^^^^^^^^^^^^^

docs/zh_CN/api-reference/protocols/esp_crt_bundle.rst

@@ -91,7 +91,7 @@ ESP x509 证书包 API 提供了一种简便的方法，帮助你安装自定义
 
 .. note::
 
-    启用交叉签名证书支持功能后，运行时的堆内存使用量将增加约 700 字节，但由于证书包体积减小，flash 占用会降低。
+    启用交叉签名证书支持功能后，TLS 握手期间的运行时堆内存峰值将增加约 1 KB。该内存为临时分配（证书验证期间构建的候选 CA 证书），握手完成后即被释放，其具体大小与支持的最大 RSA 密钥长度相关。此外，由于证书包体积减小，flash 占用也会降低。
 
 关键点：
 

docs/zh_CN/api-reference/protocols/mbedtls.rst

@@ -404,6 +404,10 @@ Mbed TLS 配置系统支持预设配置。``Component Config`` > ``mbedTLS`` 中
 
     这些值会随着配置选项和 Mbed TLS 版本的变化而变化。
 
+.. note::
+
+    :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_CROSS_SIGNED_VERIFY` 默认启用。如果无需支持交叉签名证书链，禁用该选项可将 TLS 握手期间的堆内存峰值降低约 1 KB，但代价是 flash 中的证书包体积会增大。详情请参阅 :doc:`/api-reference/protocols/esp_crt_bundle`。
+
 
 减小固件大小
 ^^^^^^^^^^^^^^^^^^