mbed-tls May 2026

mbed-tls@lists.trustedfirmware.org

2 participants
1 discussions

need help migrating to mbedtls 4.0 (esp32)

by Danny Backx

I got into trouble with migrating to the latest (v6.0) version of esp-idf, because it implies a migration to mbedtls 4.0. I had a working application (library really) to obtain ACME certificates from letsencrypt.org. I tried porting, but ran into trouble. So please help. To debug, I try to mimic the example in Appendix A.2 of RFC 7515. Where this should obviously succeed, the current output I get is : I (12:57:46.067) main_task: Calling app_main() I (12:57:46.088) Crypto: Acme standalone client example © 2026 by Danny Backx I (12:57:46.089) Crypto: checkRfc7515_a21 Base64({"alg":"RS256"}) -> eyJhbGciOiJSUzI1NiJ9 is correct I (12:57:46.094) Crypto: checkRfc7515_a21 Base64({"iss":"joe", "exp":1300819380, "http://example.com/is_root":true}) -> eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ is correct I (12:57:46.121) Crypto: checkRfc7515_a21 importPrivateKey() -> 1073741825 E (12:57:46.122) psa_crypto: psa_get_and_lock_key_slot_with_policy psa_key_policy_permits -> -133 E (12:57:46.129) psa_crypto: psa_sign_internal psa_get_and_lock_key_slot_with_policy -> -133 E (12:57:46.137) Crypto: psa_sign_hash (key 1073741825) failed (not permitted, -133 0x0085) I (12:57:46.145) Crypto: checkRfc7515_a21 Signature(eyJhbGciOiJSUzI1NiJ9,eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ) -> (null) E (12:57:46.161) Crypto: Signature 0, fail E (12:57:46.165) Crypto: RFC 7515 A.2.1 : validation failed Some of the "psa_crypto" lines come from debug statements I added in the library. The whole source for this is in one file at https://sourceforge.net/p/esp32-acme-client/code/HEAD/tree/trunk/examples/s… . Obviously it's the hashing step which I had under control with a previous library which I don't call correctly (or I don't know how to import the right key). What am I doing wrong ? Thanks, Danny -- Danny Backx - dannybackx(a)telenet.be

15 hours, 42 minutes

2026

2025

2024

2023

2022

2021

2020

mbed-tls May 2026