From e00b128221e85e5fe4c3f3333c78c739ef6eba87 Mon Sep 17 00:00:00 2001 From: liquidraver <504870+liquidraver@users.noreply.github.com> Date: Sat, 10 Oct 2026 10:35:11 +0200 Subject: [PATCH] observer TLS fix --- docs/ARCHITECTURE.md | 2 ++ releasenotes/RELEASE_NOTES_1.17.7-zephcore.md | 4 ++++ zephcore/boards/common/observer.conf | 4 ++++ zephcore/boards/common/repeater_uplink.conf | 4 ++++ 4 files changed, 14 insertions(+) diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 2368f15..30ad512 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -894,6 +894,8 @@ driver. Persisted in `prefs.json` as `zc.leds_brightness`; it is not part of the the station: up at CONNACK, down when the session ends for any reason. Keepalive: PINGREQ once a quarter of the 60 s keepalive is left, so a broker that enforces the keepalive without grace does not close an idle session. + TLS is used without certificate verification, but the chain still has to be parsed: the uplink and observer + builds carry P-256 and P-384 with SHA-256 and SHA-384 for that. - **`adapters/ota/wifi_ota.c`**: WiFi SoftAP + HTTP firmware upload to MCUboot slot1 (ESP32, requires `--sysbuild`) Companion transports, as upstream's `companion_radio`: each is a `BaseSerialInterface` diff --git a/releasenotes/RELEASE_NOTES_1.17.7-zephcore.md b/releasenotes/RELEASE_NOTES_1.17.7-zephcore.md index b0637b0..f151438 100644 --- a/releasenotes/RELEASE_NOTES_1.17.7-zephcore.md +++ b/releasenotes/RELEASE_NOTES_1.17.7-zephcore.md @@ -164,6 +164,10 @@ which resolves #107: (Heltec V3, V4, V4.3, Wireless Tracker, Wireless Tracker V2). The node sleeps between beacons once it is connected to the broker. It stays awake while it is connecting, and for as long as the WiFi network or the broker cannot be reached. +- **Brokers with a current Let's Encrypt certificate can be reached.** An uplink repeater or an + observer joined the WiFi network but never connected to a broker whose certificate chain uses + P-384 keys or SHA-384 signatures, which Let's Encrypt's ECDSA certificates do. The firmware does + not check the certificate, but it has to read it, and it could not read those. It can now. - **An idle connection to the broker is no longer dropped every two minutes.** Some brokers, and TLS front ends placed before one, close a connection that has been silent for exactly the keepalive time (60 seconds). The keepalive message was sent only when that time was already up, so on a diff --git a/zephcore/boards/common/observer.conf b/zephcore/boards/common/observer.conf index 8b24046..eb2feec 100644 --- a/zephcore/boards/common/observer.conf +++ b/zephcore/boards/common/observer.conf @@ -53,6 +53,10 @@ CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y # TLS 1.2 ciphersuite (auto-selects KEY_EXCHANGE + PSA_WANT_* dependencies) CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256=y CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256=y +# P-384 and SHA-384, to parse the broker's certificate chain +# (devdocs/lld/08-connectivity.md). Same lines in repeater_uplink.conf. +CONFIG_PSA_WANT_ALG_SHA_384=y +CONFIG_PSA_WANT_ECC_SECP_R1_384=y # TLS 1.2 only (TLS 1.3 causes handshake_failure on most MQTT brokers) # ========================================================= diff --git a/zephcore/boards/common/repeater_uplink.conf b/zephcore/boards/common/repeater_uplink.conf index b06af46..32217e5 100644 --- a/zephcore/boards/common/repeater_uplink.conf +++ b/zephcore/boards/common/repeater_uplink.conf @@ -43,6 +43,10 @@ CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=4096 CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256=y CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256=y +# P-384 and SHA-384, to parse the broker's certificate chain +# (devdocs/lld/08-connectivity.md). Same lines in observer.conf. +CONFIG_PSA_WANT_ALG_SHA_384=y +CONFIG_PSA_WANT_ECC_SECP_R1_384=y # SNTP (used by ZephyrWiFiStation) CONFIG_SNTP=y