Skip to content

Commit

Permalink
doc: Add support to set and get ciphersuites list
Browse files Browse the repository at this point in the history
  • Loading branch information
ESP-YJM committed Apr 27, 2023
1 parent 3f58b33 commit e4e2bd2
Showing 1 changed file with 19 additions and 0 deletions.
19 changes: 19 additions & 0 deletions docs/en/api-reference/protocols/esp_tls.rst
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,25 @@ SSL/TLS libraries and with all respective configurations set to default.

* An example of mutual authentication with the DS peripheral can be found at :example:`ssl mutual auth<protocols/mqtt/ssl_mutual_auth>` which internally uses (ESP-TLS) for the TLS connection.

TLS Ciphersuites
------------------------------------
ESP-TLS provides an ability to set a ciphersuites list in the client mode. TLS ciphersuites list helps to inform the server about the supported ciphersuites for the specific TLS connection (irrespective of the TLS stack configuration). If the server supports any ciphersuite from this list then the TLS connection shall succeed, otherwise it would fail.

You can set ``ciphersuites_list`` in the :cpp:type:`esp_tls_cfg_t` structure during client connection as follows:

.. code-block:: c
/* ciphersuites_list must end with 0 and must be available in the memory scope active during the entire TLS connection */
static const int ciphersuites_list[] = {MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 0};
esp_tls_cfg_t cfg = {
.ciphersuites_list = ciphersuites_list,
};
ESP-TLS will not check the validity of ``ciphersuites_list`` that was set, you should call :cpp:func:`esp_tls_get_ciphersuites_list` to get ciphersuites list supported in the TLS stack and cross-check it against the supplied list.

.. note::
This feature is supported only in the mbedTLS stack.

API Reference
-------------

Expand Down

0 comments on commit e4e2bd2

Please sign in to comment.