Security & TLS

  • security
  • TLS
  • ESP-TLS
  • HTTPS
  • WSS

How can ESP-TLS skip server certificate verification?

In ESP-TLS on ESP32, server certificate verification can be skipped for quickly establishing HTTPS / WSS connections during testing.

Enable the following options in menuconfig:

  • CONFIG_ESP_TLS_INSECURE
  • CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY

esp_tls_config

After these options are enabled, if esp_tls_cfg_t does not configure any of the following server verification methods, ESP-TLS skips server certificate verification:

  • cacert_buf
  • use_global_ca_store
  • crt_bundle_attach

Example:

esp_tls_cfg_t cfg = {
    .cacert_buf = NULL,
    .use_global_ca_store = false,
    .crt_bundle_attach = NULL,
    .timeout_ms = 10000,
};

Security risks:

  • The server identity cannot be verified.
  • The connection is vulnerable to man-in-the-middle attacks.
  • The device may connect to a forged server.
  • Data may be intercepted or modified.

Notes:

  • Use this only in test environments.
  • Do not use it in production.
  • Do not use it on public or untrusted networks.
  • In production, prefer CA certificates or a certificate bundle for verification.