Do Any SSL/WSS Components Perform Expiration Validation?

[oklambdago]

Hi There,

I am using encryption in several IDF components:

1. Http Client -- requests to https, for which I supply a certificate
2. OTA -- the firmware downloads from a https url, for which I supply a certificate
3. MQTT -- wss://, for which I DO NOT provide a certificate.

Question 1:
I know 1 and 2 perform CN checking by default, however I am not sure about CN checking for wss://. Is CN checking performed for 3?

Question 2:
DO ANY of the above methods check expiration time? I have read in several places that by default no expiration checking is done. I'm not setting the time on the device so I don't even know how it would be possible. If possible, I'd like to disable all expiration checking.

Thanks!

[ESP-Marius]

1. CN checking should be performed by default unless you've disabled it (see skip_cert_common_name_check in the MQTT config struct)

2. Expiration checking is controlled by the MBEDTLS_HAVE_TIME_DATE setting in menuconfig. Which should be disabled by default.

[oklambdago]

Thanks for the quick and helpful answer ESP-Marius!