Skip to content

Commit

Permalink
change(esp-tls): make wolfSSL backend send SNI and enable OCSP
Browse files Browse the repository at this point in the history
Almost all sites these days are virtually hosted and hence
SNI (server name indicator TLS extension) should be enabled by
default.

In addition this change enables OCSP (online server status protocol)
support for esp-tls clients using the wolfSSL backend.
The 3 code lines enable OCSP stabling v1.
By default this feature is disabled.
(I will send another PR on esp-wolfssl repository to allow to
enable it easily.)
  • Loading branch information
frankencode committed Apr 15, 2024
1 parent 05d3c06 commit edd260e
Showing 1 changed file with 8 additions and 0 deletions.
8 changes: 8 additions & 0 deletions components/esp-tls/esp_tls_wolfssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,14 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls
#endif /* CONFIG_WOLFSSL_HAVE_ALPN */
}

#ifdef CONFIG_WOLFSSL_HAVE_OCSP
wolfSSL_CTX_EnableOCSPStapling((WOLFSSL_CTX *)tls->priv_ctx );
wolfSSL_UseOCSPStapling((WOLFSSL *)tls->priv_ssl, WOLFSSL_CSR_OCSP, 0);
wolfSSL_CTX_EnableOCSP((WOLFSSL_CTX *)tls->priv_ctx, 0);
#endif

wolfSSL_CTX_UseSNI(tls->priv_ctx, WOLFSSL_SNI_HOST_NAME, hostname, hostlen);

wolfSSL_set_fd((WOLFSSL *)tls->priv_ssl, tls->sockfd);
return ESP_OK;
}
Expand Down

0 comments on commit edd260e

Please sign in to comment.