From 825c3d075a7ac6e11505dfc4a59140282884e1a0 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 17 Feb 2025 17:41:54 +0100 Subject: [PATCH] Add a note about calling mbedtls_ssl_set_hostname to mbedtls_ssl_setup Signed-off-by: Gilles Peskine --- include/mbedtls/ssl.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 0eaec5c8ca..b15bbb6665 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -2015,6 +2015,17 @@ void mbedtls_ssl_init(mbedtls_ssl_context *ssl); * \note The PSA crypto subsystem must have been initialized by * calling psa_crypto_init() before calling this function. * + * \note After setting up a client context, if certificate-based + * authentication is enabled, you should call + * mbedtls_ssl_set_hostname() to specifiy the expected + * name of the server. Otherwise, if server authentication + * is required (which is the case by default) and the + * selected key exchange involves a certificate (i.e. is not + * based on a pre-shared key), the certificate authentication + * will fail. See + * #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * for more information. + * * \param ssl SSL context * \param conf SSL configuration to use *