Skip to content

v0.1.2 — TLS pinning fixes

Latest
Latest

Choose a tag to compare

View all tags
@decoded-cipher decoded-cipher released this 12 Nov 14:13
v0.1.2
280989a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release that makes certificate pinning reliable. Recommended for any device that calls setCACert() or setFingerprint().

Fixes

  • A certificate pin is never silently dropped. On some boards and transports a pin was ignored and the device connected without validating the server, sending its project token over an unverified link. Now:
    • setCACert() works on ESP8266 as well as ESP32, for both WebSocket and HTTP.
    • setFingerprint() works on the ESP8266 WebSocket, not just HTTP.
    • A pin that can't be applied (a fingerprint on ESP32, or a malformed fingerprint) makes the connection fail instead of falling back to an unvalidated one.
  • Clearer warnings. With setDebug(true), begin() / beginHTTP() warn when certificates aren't being validated, or when setFingerprint() is used on ESP32.

Without a pin, behaviour is unchanged: certificates are not validated by default. Pin a root CA with setCACert() to validate. See the README's TLS section.

Install

Available from the Arduino Library Manager (search Nodrix), the PlatformIO Registry (lib_deps = decoded-cipher/Nodrix), and the ESP Component Registry (idf.py add-dependency "decoded-cipher/nodrix"). Dependencies install automatically.

Assets 2
Loading