Open kristiankielhofner opened 11 months ago
It appears ESP-TLS does not support TLS 1.3 yet. Initial support was added in master: espressif/esp-idf@7fd1378fbb0b81231a83f91f8227f8fb083635a5.
After manually initializing the Mbed TLS PSA library and enabling CONFIG_MBEDTLS_DEBUG in sdkconfig, there's a different error:
W (20:32:56.020) mbedtls: ssl_tls13_generic.c:653 x509_verify_cert() returned -9984 (-0x2700)
W (20:32:56.021) mbedtls: ssl_tls13_generic.c:693 got no CA chain
So it appears CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY doesn't work anymore with TLS 1.3. This appears to be because of MBEDTLS_SSL_VERIFY_NONE not doing what's expected. MBEDTLS_SSL_VERIFY_OPTIONAL still works. With the following change, cert verification is no longer a problem:
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -571,7 +571,7 @@ MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl)
{
int ret = 0;
- int authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
+ int authmode = MBEDTLS_SSL_VERIFY_OPTIONAL;
mbedtls_x509_crt *ca_chain;
mbedtls_x509_crl *ca_crl;
const char *ext_oid;```
But then we hit the next error in esp_tls:
E (21:34:34.251) transport_base: esp_tls_conn_read error, errno=Connection already in progress
E (21:34:34.252) WILLOW/HTTP: failed to get HTTP headers
At this point it's probably better to wait for a new IDF release where it is properly supported.
We have initial IDF 5.1 support and it has a new mbedtls implementation that supports TLS 1.3. Unfortunately, it errors on HTTP stream to WIS/nginx when TLS 1.3 is enabled: