SSL support for ESP32

[chessweb01]

I'm porting my app from ESP8266 to ESP32. When I enable SSL the compiler tells me "tcp_axtls.h: No such file or directory".

Is that due to the fact that me-no-dev/AsyncTCP still doesn't support SSL?

[tve]

You are correct. If you're adventurous, you could try https://github.com/tve/async-mqtt-client
See also me-no-dev/AsyncTCP#43

[OscarArgueyo]

You are correct. If you're adventurous, you could try https://github.com/tve/async-mqtt-client
See also me-no-dev/AsyncTCP#43

Is it possible to merge that fork with this repository? I know this is an old issue.
We are still facing troubles when we try to connect our ESP32 over ssl with the ASYNC_TCP_SSL_ENABLED flag.
The file tcp_axtls.h is still a missing dependencies even though that file is from the ESP8266 version of me-no-dev/ESPAsyncTCP

Thanks!

[qwandor]

Is there any update on this? Can the fork mentioned above be merged?

[kfine100]

Is there an update on this? I need client SSL support only for the ESP32. I will try tve's branch, but the "if you're adventurous" comment does not inspire confidence!

[luebbe]

I guess the situation is still the same if interpret @bertmelis #239 (comment) correclty

[bertmelis]

It's trivial to patch this lib (maybe we should?).
Next, you'll have to use (for example) tve's fork of AsyncTCP, the correct branch.

I believe that's all to it. There is no certificate check though, so MITM is not covered.

[kleini]

Why does async-mqtt-client need a patch for SSL support for ESP32? That should be the responsibility of AsyncTCP or am I wrong here?

[bertmelis]

Why does async-mqtt-client need a patch for SSL support for ESP32? That should be the responsibility of AsyncTCP or am I wrong here?

It won't compile because the methods in AsyncTCP and ESPAsyncTCP are not the same. There is also no fingerprint checking available in AsyncTCP.

[kleini]

Thanks. I thought AsyncTCP is just the ESP32 equivalent of ESPAsyncTCP.

[bertmelis]

It is, but not the TLS part. (there are also some behavioural specifics)

[kfine100]

I tried out tve's branch and I cannot even get it to compile! I am probably making an obvious error. If anyone could help I would appreciate it.

I am programming the ESP 32 on PlatformIO on Visual Studio. The Arduino framework. I have been using AsyncMQTTClient for a while and it works great. Now I am trying to get SSL going on my client (the ESP32).

So I changed to using tve's fork of async-mqtt-client along with his fork of AsyncTCP. I followed his instructions here

https://github.com/tve/AsyncTCP/tree/mbed-tls

including adding build_flags = -DASYNC_TCP_SSL_ENABLED=true to platformio.ini.

I get the compiler errors

In file included from .pio/libdeps/esp32dev/AsyncTCP/src/AsyncTCP.cpp:24:0:
.pio/libdeps/esp32dev/AsyncTCP/src/AsyncTCP.h: In constructor 'AsyncClient::AsyncClient(tcp_pcb*)':
.pio/libdeps/esp32dev/AsyncTCP/src/AsyncTCP.h:77:11: error: 'AsyncClient::_root_ca' will be initialized after [-Werror=reorder]
char* _root_ca;
^
.pio/libdeps/esp32dev/AsyncTCP/src/AsyncTCP.h:76:12: error: 'size_t AsyncClient::_root_ca_len' [-Werror=reorder]
size_t _root_ca_len;
^
.pio/libdeps/esp32dev/AsyncTCP/src/AsyncTCP.cpp:411:1: error: when initialized here [-Werror=reorder]
AsyncClient::AsyncClient(tcp_pcb* pcb)

Another odd thing is that tcp_mbedtls.c is greyed out is VS, even though the #if ASYNC_TCP_SSL_ENABLED shows true. I do not know if that is related but I do not understand it. This must be used, right?

I do not need to use certificates but will use pre-shared keys. Looks like I will need to call setPsk with the key, but I need to get it to compile first!

Thanks for any help, Kevin

[luebbe]

the [-Werror=reorder] error means that the parameters in the constructor are passed in a different order than they were defined in the .h file. This should normally be easy to fix by swapping the corresponding parameters in the constructor.

[kfine100]

Thanks luebbe, you are right. Just switching the declarations in ASynchTCP.h like this

char* _root_ca;
size_t _root_ca_len;

and the errors went away. Also my "greyed" out problem in tcp_mbedtls.c was caused by defining DASYNC_TCP_SSL_ENABLED both in the code and in a build flag. I removed the definition and the gray went away (yay!).

I would like to encourage the authors to add the client PSK encryption into the master. A little more documentation would help, for example, which of these is supported?

CipherSuite Key Exchange Cipher Hash

TLS_PSK_WITH_RC4_128_SHA PSK RC4_128 SHA
TLS_PSK_WITH_3DES_EDE_CBC_SHA PSK 3DES_EDE_CBC SHA
TLS_PSK_WITH_AES_128_CBC_SHA PSK AES_128_CBC SHA
TLS_PSK_WITH_AES_256_CBC_SHA PSK AES_256_CBC SHA

I am also wondering: is any of the ESP32 encryption hardware used? mbedtls looks to be pure software so maybe it can be sped up.

Once I get it working I will be glad to write up any details I learn. Encrypted MQTT is useful for a lot of Edge computing.

Kevin

[bertmelis]

I'm not not even remotely familiar with TLS. So can't answer these questions.
However, if you needed to patch the MQTT client, I cordially invite you to create a PR in the develop branch.