pioduino/esp-idf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'feature/esp_crt_bundle_deprecated_list' into 'master'

Browse Source 
esp_crt_bundle: add support for deprecated cert list and relevant config

Closes IDF-8188 and IDFGH-10992

See merge request espressif/esp-idf!26734
This commit is contained in:
Mahavir Jain
2023-11-02 12:07:58 +08:00
parent 144ee32e58 64cb35deef
commit 7441cdb82b
7 changed files with 343 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/en/api-reference/protocols/esp_crt_bundle.rst
+6 -1
View File
@@ -16,7 +16,7 @@ The bundle comes with the complete list of root certificates from Mozilla's NSS
When generating the bundle you may choose between:
* The full root certificate bundle from Mozilla, containing more than 130 certificates. The current bundle was updated Tue Jan 10 04:12:06 2023 GMT.
* The full root certificate bundle from Mozilla, containing more than 130 certificates. The current bundle was updated Tue Aug 22 03:12:04 2023 GMT.
* A pre-selected filter list of the name of the most commonly used root certificates, reducing the amount of certificates to around 41 while still having around 90% absolute usage coverage and 99% market share coverage according to SSL certificate authorities statistics.
In addition, it is possible to specify a path to a certificate file or a directory containing certificates which then will be added to the generated bundle.
@@ -76,6 +76,11 @@ Updating the Certificate Bundle
The bundle is embedded into the app and can be updated along with the app by an OTA update. If you want to include a more up-to-date bundle than the bundle currently included in ESP-IDF, then the certificate list can be downloaded from Mozilla as described in :ref:`updating_bundle`.
Periodic Sync
-------------
The bundle is kept updated by periodic sync with the Mozilla's NSS root certificate store. The deprecated certs from the upstream bundle are added to deprecated list (for compatibility reasons) in ESP-IDF minor or patch release. If required, the deprecated certs can be added to the default bundle by enabling :ref:`CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEPRECATED_LIST`. The deprecated certs shall be removed (reset) on the next major ESP-IDF release.
Application Examples
--------------------