search

JiriBilek / WiFiSpi

SPI library for Arduino AVR and STM32F1 to connect to ESP8266
GNU Lesser General Public License v3.0
62 stars 13 forks source link

ESP8266: change AxTLS to BearSSL #23

Closed JiriBilek closed 3 years ago

JiriBilek commented 3 years ago

The AxTLS is now in https://github.com/esp8266/Arduino deprecated and should not be used. Change to BearSSL gives us more control over certificate validation but requires some changes on client side:

  1. the default SSL connection should be established as insecure. While this is really bad in terms of security, it is required for not breaking the existing code.
  2. remove WiFiSpiClient::verifySSL function
  3. add WiFiSpiClient::setFingerprint function. Good first step but rather difficult to maintain with short-life certificates (e.g. from the Let's Encrypt authority)
  4. think about adding full certificate chain validation. It requires loading valid CA certificate into the ESP.
JiriBilek commented 3 years ago

Done in version 0.3.0