Skip to content

feat(esp8266): support MQTT TLS with fingerprint pinning#1

Open
2asoft wants to merge 1 commit into
esphome-libs:masterfrom
2asoft:aasoft/esp8266-mqtt-tls
Open

feat(esp8266): support MQTT TLS with fingerprint pinning#1
2asoft wants to merge 1 commit into
esphome-libs:masterfrom
2asoft:aasoft/esp8266-mqtt-tls

Conversation

@2asoft
Copy link
Copy Markdown
Collaborator

@2asoft 2asoft commented Mar 25, 2026

Summary

Add ESP8266 MQTT TLS support with server fingerprint pinning.

This wires the MQTT client to the ESP8266 BearSSL-capable ESPAsyncTCP transport so secure connections can be configured with pinned server fingerprints and fingerprint failures surface through the existing
disconnect reasons.

Changes

  • add ESP8266 TLS session setup for the BearSSL transport
  • plumb configured server fingerprints into the ESP8266 TLS connect path
  • map fingerprint mismatches to AsyncMqttClientDisconnectReason::TLS_BAD_FINGERPRINT
  • keep the existing non-ESP8266 SSL fingerprint behavior intact
  • relax the ESP8266 TCP dependency in library.json from a pinned package identity to the generic ESPAsyncTCP library name, so consuming projects can choose the concrete ESP8266 TCP library source

Why

ESPHome needs secure MQTT on ESP8266 with fingerprint pinning. This restores that capability.

Verification

Verified downstream in ESPHome using local dependency overrides to this branch and the matching ESPAsyncTCP branch.

Configure ESP8266 BearSSL sessions from the MQTT client, map fingerprint mismatches into the existing disconnect reasons, and keep MQTT publish/keepalive handling compatible with the TLS transport used by downstream ESPHome builds.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant