Allow the https server to request client certs only with OPTIONAL (IDFGH-16506)

[0xFEEDC0DE64]

I want to serve my webinterface via https to smartphones and the manufacturer should have special permissions and we authenticate developers or production using client key / cert. The end customer will not have such a cert. The connection should not fail, but our internal APIs will then refuse to work.

[github-actions]

Warnings

⚠️

Some issues found for the commit messages in this PR: the commit message "Allow the https server to request client certs only with OPTIONAL": summary looks empty type/action looks empty Please fix these commit messages - here are some basic tips: follow Conventional Commits style correct format of commit message should be: <type/action>(<scope/component>): <summary>, for example fix(esp32): Fixed startup timeout issue allowed types are: change,ci,docs,feat,fix,refactor,remove,revert,test sufficiently descriptive message summary should be between 20 to 72 characters and start with upper case letter avoid Jira references in commit messages (unavailable/irrelevant for our customers) TIP: Install pre-commit hooks and run this check when committing (uses the Conventional Precommit Linter).

👋 Hello 0xFEEDC0DE64, we appreciate your contribution to this project!

---

📘 Please review the project's Contributions Guide for key guidelines on code, documentation, testing, and more.

---

🖊️ Please also make sure you have read and signed the Contributor License Agreement for this project.

---

Click to see more instructions ...

This automated output is generated by the PR linter DangerJS, which checks if your Pull Request meets the project's requirements and helps you fix potential issues.

DangerJS is triggered with each push event to a Pull Request and modify the contents of this comment.

Please consider the following:
- Danger mainly focuses on the PR structure and formatting and can't understand the meaning behind your code or changes.
- Danger is not a substitute for human code reviews; it's still important to request a code review from your colleagues.
- Resolve all warnings (⚠️ ) before requesting a review from human reviewers - they will appreciate it.
- To manually retry these Danger checks, please navigate to the Actions tab and re-run last Danger workflow.

Review and merge process you can expect ...

We do welcome contributions in the form of bug reports, feature requests and pull requests via this public GitHub repository.

This GitHub project is public mirror of our internal git repository

1. An internal issue has been created for the PR, we assign it to the relevant engineer.
2. They review the PR and either approve it or ask you for changes or clarifications.
3. Once the GitHub PR is approved, we synchronize it into our internal git repository.
4. In the internal git repository we do the final review, collect approvals from core owners and make sure all the automated tests are passing.
- At this point we may do some adjustments to the proposed change, or extend it by adding tests or documentation.
5. If the change is approved and passes the tests it is merged into the default branch.
5. On next sync from the internal git repository merged change will appear in this public GitHub repository.

Generated by 🚫 dangerJS against 6213a90

[mahavirj]

@0xFEEDC0DE64

We have a configuration knob for this here:

esp-idf/components/esp-tls/Kconfig

Line 63 in 5c5eb99

config ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL

Please see if that can help!

Edit: Probably we should be using this config in the if block where cacert_buf is not NULL CC @Ashish285

[0xFEEDC0DE64]

Hi thanks for sharing, but it does not help, since this completely breaks the security of my mqtt broker that verifies clients. I only want it optional for the https server

[Ashish285]

Looks good to me. Maybe the new runtime config should be under ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL to have a compile time switch available for this? So there will be compile time switch to enable the functionality and then runtime config to select which server it applies to

[0xFEEDC0DE64]

Do you think just offering this option all the time is a risk? If applications don't set it, behaviour should stay the same. That's why its set to true to reduce the cert checking.

[Ashish285]

Hi @0xFEEDC0DE64 , My suggestion to have compile time switch is to enforce the configuration (as is the case currently). Along with the runtime check that you have enabled, we can cater to all different use cases. Having a compile time switch also helps to enforce a secure profile.

Let me know your thoughts, we will be happy to include this PR.

[hurricanefrog]

"External opinion": I would suggest adding curly braces here, to stay consistent with the rest of the code. (Which also adds curly braces even for single statements, at least as far as I can see in the context).

[Ashish285]

Hi @0xFEEDC0DE64 , thanks for the PR. I will accept it and make any changes regarding the compile time switches internally if required.

[Ashish285]

sha=6213a906c049d08f5bc1a372aad1577dee26fdf1