Patch release that makes certificate pinning reliable. Recommended for any device that calls setCACert() or setFingerprint().
Fixes
- A certificate pin is never silently dropped. On some boards and transports a pin was ignored and the device connected without validating the server, sending its project token over an unverified link. Now:
setCACert()works on ESP8266 as well as ESP32, for both WebSocket and HTTP.setFingerprint()works on the ESP8266 WebSocket, not just HTTP.- A pin that can't be applied (a fingerprint on ESP32, or a malformed fingerprint) makes the connection fail instead of falling back to an unvalidated one.
- Clearer warnings. With
setDebug(true),begin()/beginHTTP()warn when certificates aren't being validated, or whensetFingerprint()is used on ESP32.
Without a pin, behaviour is unchanged: certificates are not validated by default. Pin a root CA with setCACert() to validate. See the README's TLS section.
Install
Available from the Arduino Library Manager (search Nodrix), the PlatformIO Registry (lib_deps = decoded-cipher/Nodrix), and the ESP Component Registry (idf.py add-dependency "decoded-cipher/nodrix"). Dependencies install automatically.