Skip to content

fix(libtls): enable SECP384R1 and raise default TLS content length fo… - #712

Merged
yingtao450 merged 1 commit into
masterfrom
fix/libtls-us-region-tls
Sep 20, 2026
Merged

yingtao450 merged 1 commit into
masterfrom
fix/libtls-us-region-tls

Conversation

@yingtao450

Copy link
Copy Markdown
Contributor

…r US region

US-region cloud chains (rtc-ai*.iot-wus.com -> DigiCert Global Root G3) carry an ECDSA P-384 root certificate. With only SECP256R1 compiled in, certificate parsing fails with MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE (-0x3a00) during the TLS handshake, so US-region AI connections never establish while CN region (RSA/P-256 chains) works fine.

Also raise ENABLE_MBEDTLS_SSL_MAX_CONTENT_LEN default from 1024 to 4096: the US chain Certificate message is ~2.6KB (leaf 1187 + intermediate 844

  • root 579), which exceeds 1024 unless the peer honors max_fragment_length.

PR 描述/PR description

[在此详细描述 PR 的内容]/[Describe the PR content in detail here]

代码质量/Code Quality:

在本次拉取请求中,我已考虑以下事项 As part of this pull request, I've considered the following:

  • 确保代码注释和文档清晰,并使用英文注释以保证代码可读性。Ensure that the code comments and documentation are clear, and use English for comments to ensure code readability.
  • 确保文件头遵循文件头格式。Ensure that the file header follows the File Header Format.
  • 确保函数头遵循 Doxygen 格式。Ensure that function headers follow the Doxygen format as specified in Comments.
  • 已查阅 编码风格指南,并核查代码风格合规性,包括缩进、空格、命名规范及其他风格要求。 Reviewed the Coding Style Guide and verified code style compliance, including indentation, spacing, naming conventions, and other style guidelines.
  • 已使用代码格式化工具确保符合 TuyaOpen 编码规范。Have used the code-formatting source code formatting tool to ensure compliance with TuyaOpen coding standards.

…r US region

US-region cloud chains (rtc-ai*.iot-wus.com -> DigiCert Global Root G3)
carry an ECDSA P-384 root certificate. With only SECP256R1 compiled in,
certificate parsing fails with MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE
(-0x3a00) during the TLS handshake, so US-region AI connections never
establish while CN region (RSA/P-256 chains) works fine.

Also raise ENABLE_MBEDTLS_SSL_MAX_CONTENT_LEN default from 1024 to 4096:
the US chain Certificate message is ~2.6KB (leaf 1187 + intermediate 844
+ root 579), which exceeds 1024 unless the peer honors max_fragment_length.
@yingtao450
yingtao450 merged commit 91e070c into master Sep 20, 2026
2 checks passed
@shiliu-yang
shiliu-yang deleted the fix/libtls-us-region-tls branch September 20, 2026 10:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants