From 58657d484ab51950933e1ba8b4424344900ed5bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20G=C3=B6ttgens?= Date: Mon, 3 Aug 2026 14:49:21 +0200 Subject: [PATCH] Re-enable mbedtls secp384r1 on ESP32 (#11344) Let's Encrypt Generation Y chains sign a P-256 leaf with the P-384 intermediate YE1 under ISRG Root YE. mqtt.meshtastic.org switched to this chain on 2026-07-29. With CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED=n mbedtls cannot parse the peer chain and the TLS handshake aborts with MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE, breaking MQTT over TLS on every ESP32 target. Costs about 4 kB of flash. Fixes #11316 --- variants/esp32/esp32-common.ini | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/variants/esp32/esp32-common.ini b/variants/esp32/esp32-common.ini index 813519b2c..78977756e 100644 --- a/variants/esp32/esp32-common.ini +++ b/variants/esp32/esp32-common.ini @@ -232,7 +232,12 @@ custom_sdkconfig = CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE=n CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED=n CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED=n - CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED=n + ; Required, do not disable. Let's Encrypt "Generation Y" chains (used by + ; mqtt.meshtastic.org since 2026-07-29) sign a P-256 leaf with the P-384 + ; intermediate YE1 under ISRG Root YE. Without this curve mbedtls cannot + ; parse the chain and every TLS handshake fails with + ; MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE (-0x3A00). Costs ~4 kB flash. (#11316) + CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED=y CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED=n CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED=n CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED=n