esp-wolfssl: esp_key_config_t server key support, ESP-IDF <6.0 build fix, and ESP_TLS_HAS_WOLFSSL macro#32
Open
hrushikesh430 wants to merge 4 commits into
Conversation
Collaborator
Author
Runtime test logsTested on ESP-IDF master (v6.2-dev), ESP32-C3, esp-wolfssl as the esp-tls custom stack. examples/protocols/https_request — device serial (TLS 1.2 → HTTP 200)examples/protocols/https_server/simple — device serial + client curl (mutual TLS → HTTP 200) |
Collaborator
Author
|
@AdityaHPatwardhan PTAL |
Collaborator
Author
On-device firmware log — ESP-IDF v5.5.4 (ESP32-C3)esp-wolfssl exercised via the native wolfSSL API (
wolfssl_client — device serial (v5.5.4, ESP32-C3) |
hrushikesh430
force-pushed
the
feature/add_idf_component_yml_and_server_key
branch
from
July 14, 2026 06:40
3b80797 to
6d3fd88
Compare
hrushikesh430
changed the title
Collaborator
Author
Build log — ESP-IDF v5.5.4 (
|
Collaborator
|
Has this been tested on esp-idf v5.5, v6.0 and v6.1 ( master) |
hrushikesh430
force-pushed
the
feature/add_idf_component_yml_and_server_key
branch
from
July 14, 2026 08:09
6d3fd88 to
6d9a06e
Compare
Collaborator
Author
More runtime/build logsesp-wolfssl device serial (TLS 1.2 → HTTP 200)ESP-IDF v6.0.1 (ESP32-C3) — both esp-idf examples build + wolfSSL registers as the custom stack (also confirms the v6.0.1 build + registration |
Collaborator
Author
ESP-IDF v6.0.1 runtime (ESP32) — both examples, HTTP 200Now captured end-to-end on ESP-IDF v6.0.1 (ESP32, esp-wolfssl custom stack): examples/protocols/https_request — device serial (TLS 1.2 → HTTP 200)examples/protocols/https_server/simple — device + curl (mutual-TLS → HTTP 200 "Hello Secure World!") |
… client paths
esp_https_server / esp_tls (and their examples) pass the private key via the
unified esp_key_config_t (cfg->server_key / cfg->client_key) instead of the
legacy serverkey_buf / clientkey_buf on newer ESP-IDF. Accept the unified key
config (ESP_KEY_SOURCE_BUFFER) as a fallback on both the server and client
paths. The interface was added to esp-tls after v6.0, so it is detected via
__has_include("esp_key_config.h") to keep building on v6.0 and earlier (which
only have the *_buf fields).
port/esp_tls_wolfssl.c includes esp_tls_custom_stack.h, which only exists in ESP-IDF v6.0+. Exclude it from the sources when CONFIG_ESP_TLS_CUSTOM_STACK is unset, so the component still builds on v5.5 and earlier (native wolfSSL API).
Lets application code feature-detect the wolfSSL backend with #ifdef ESP_TLS_HAS_WOLFSSL, mirroring the macro ESP-IDF defined when wolfSSL was a built-in esp-tls backend. Migrated from esp-idf#17682 (supersedes PR espressif#29).
The component is consumed by cloning it and adding a path-based dependency; remove the IDF Component Registry / add-dependency instructions.
hrushikesh430
force-pushed
the
feature/add_idf_component_yml_and_server_key
branch
from
July 14, 2026 09:24
6d9a06e to
8fe8b0c
Compare
hrushikesh430
marked this pull request as ready for review
July 14, 2026 09:37
Collaborator
Author
|
@AdityaHPatwardhan PTAL |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
port/esp_tls_wolfssl.c— accept the unifiedesp_key_config_t(cfg->server_key/cfg->client_key) on the esp-tls server and client paths, in addition to the legacyserverkey_buf/clientkey_buf. The unified key interface was added to esp-tls after v6.0, so it is detected via__has_include("esp_key_config.h")(not an IDF version number) to keep building on v6.0 and earlier.CMakeLists.txt— don't compileport/esp_tls_wolfssl.cwhenCONFIG_ESP_TLS_CUSTOM_STACKis unset (it uses the 6.0-onlyesp_tls_custom_stack.h), so the component builds on ESP-IDF < 6.0 (native-API use).include/esp_wolfssl_stack.h— defineESP_TLS_HAS_WOLFSSLfor feature detection. Migrated from feat(esp-wolfssl): Defined the ESP_TLS_HAS_WOLFSSL macro #29 (esp-idf#17682); supersedes and closes feat(esp-wolfssl): Defined the ESP_TLS_HAS_WOLFSSL macro #29.README.md— document path-based (clone) usage; drop the registry /add-dependencyinstructions.Why the code changes
36090b71611(feat(esp-tls): Add unified private key interface via esp_key_config_t) switchedesp_https_server/https_server/simpleto pass the key viacfg->server_keyinstead ofserverkey_buf. The wolfSSL port only readserverkey_buf, sohttps_server/simplefailed withesp-tls-wolfssl: You have to provide both servercert_buf and serverkey_buf. The client path (client_key) had the same gap.< 6.0build fix —esp_tls_custom_stack.hexists only in v6.0+, but the custom-stack file was compiled unconditionally, so on v5.5 the build failed withfatal error: esp_tls_custom_stack.h: No such file or directory.Testing
Backend = esp-wolfssl. On IDF 6.0+ it is the esp-tls custom stack (
CONFIG_ESP_TLS_CUSTOM_STACK=y); on < 6.0 it is used via the native wolfSSL API (custom stack does not exist there). Logs attached in the comments below.https_requesthttps_server/simpleHello Secure World!examples/https_requesthttps_requesthttps_server/simpleHello Secure World!examples/wolfssl_clientBuilds: master (v6.2-dev) ✅ · v6.0.1 ✅ · v5.5.4 ✅. On v6.0.1 the
__has_includeguard is also exercised (thereesp_key_config.his absent, soserver_key/client_keyare correctly excluded); on v5.5.4 the component builds only becauseesp_tls_wolfssl.cis excluded (< 6.0fix).