mirrors
/
Tasmota
mirror of https://github.com/arendst/Tasmota.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Minor changes to word order, syntax and spelling to improve readability.

PuceBaboon 2019-08-12 08:41:56 +09:00
parent ca3d8d5784
commit 970e957115
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
TLS.md

@ -8,15 +8,15 @@ Starting version 6.5.0.15, there are major changes to TLS to make it lighter in
At the TASMOTA configuration, you need to enable to use the TLS Version. This is done by enable `#define USE_MQTT_TLS` in `sonoff/my_user_config.h` and change the port number to `8883`. At the TASMOTA configuration, you need to enable to use the TLS Version. This is done by enable `#define USE_MQTT_TLS` in `sonoff/my_user_config.h` and change the port number to `8883`.
If you are using Letsencrypt to generate your server certificates, you should activate `#define USE_MQTT_TLS_CA_CERT`. Tasmota will transparently check the servers certificate with Letsencrypt CA. If you are generating self-signed certificates or prefer fingerprints, read below. If you are using Letsencrypt to generate your server certificates, you should activate `#define USE_MQTT_TLS_CA_CERT`. Tasmota will transparently check the server's certificate with Letsencrypt CA. If you are generating self-signed certificates or prefer fingerprints, read below.
### Fingerprint validation ### Fingerprint validation
The fingerprint is now calculated on the server's Public Key and no longer on its Certificate. The good news is that Public Keys tend to change far less often than certificates, i.e. Letscencrypt triggers a certificate renewal every 3 months, the Public Key fingerprint will not change after a certificate renewal. The bad news is that there is no simple command to retrieve the server's Public Key fingerprint. The fingerprint is now calculated on the server's Public Key and no longer on its Certificate. The good news is that Public Keys tend to change far less often than certificates, i.e. Letscencrypt triggers a certificate renewal every 3 months, the Public Key fingerprint will not change after a certificate renewal. The bad news is that there is no simple command to retrieve the server's Public Key fingerprint.
So to simplify your task, we have added two more options: 1/ auto-learn of fingerprint, 2/ disabling all-together the fingerprint validation. So to simplify your task, we have added two more options: 1/ auto-learning of the fingerprint, 2/ disabling of the fingerprint validation altogether.
**Option 1: Fingerprint auto-learn.** If set, Tasmota will automatically learn the fingerprint during the first connection and will set the Fingerprint settings to the targer fingerprint. To do so, use one of the following commands: **Option 1: Fingerprint auto-learn.** If set, Tasmota will automatically learn the fingerprint during the first connection and will set the Fingerprint settings to the target fingerprint. To do so, use one of the following commands:
``` ```
MqttFingerprint1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 MqttFingerprint1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
@ -28,7 +28,7 @@ or
MqttFingerprint2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 MqttFingerprint2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
``` ```
**Option 2: Disable Fingerpring.** You can completely disable server fingerprint validation, which means that Tasmota will not check the server's identity. It means that your traffic can possibly be intercepted and read/changed. This should be used only on trusted networks, i.e. with an MQTT on your local network. **YOU HAVE BEEN WARNED!** **Option 2: Disable Fingerprint.** You can completely disable server fingerprint validation, which means that Tasmota will not check the server's identity. This also means that your traffic can possibly be intercepted and read/changed, so this option should only be used on trusted networks, i.e. with an MQTT on your local network. **YOU HAVE BEEN WARNED!**
To do so, set one of the Fingerprints to all 0xFF: To do so, set one of the Fingerprints to all 0xFF:
@ -38,13 +38,13 @@ MqttFingerprint2 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
### Limitations: ### Limitations:
Starting with 6.5.0.15, AxTLS has been replaced with [BearSSL](https://bearssl.org/). This allows a much lighter use of memory - typically 6.0k constantly, and an additional 6.8k during TLS connection. This makes TLS now compatible with Web and Hue/Wemo emulation. Starting with 6.5.0.15, AxTLS has been replaced with [BearSSL](https://bearssl.org/). This allows a much lighter use of memory - typically 6.0k constantly, and an additional 6.8k during TLS connection. This now makes TLS compatible with Web and Hue/Wemo emulation.
The main limitations are: The main limitations are:
- Your SSL/TLS server must support the TLS 1.2 and the `RSA_WITH_AES_128_GCM_SHA256` cipher - which is the case with default Mosquitto configuration - Your SSL/TLS server must support TLS 1.2 and the `RSA_WITH_AES_128_GCM_SHA256` cipher - which is the case with the default Mosquitto configuration
- The server certificate must have an RSA private key (max 2048 bits) and the certificate must be signed with RSA and SHA256 hash. This is the case with default Letsencrypt certificates. - The server certificate must have an RSA private key (max 2048 bits) and the certificate must be signed with RSA and SHA256 hash. This is the case with default Letsencrypt certificates.
- Your SSL/TLS should support TLS 1.2 MFLN to limit buffer to 1024 bytes. If MFLN is not supported, it will still work well as long as the server does not send any message above 1024 bytes (which should be ok, since Tasmota cannot parse MQTT messages above 1024 bytes) - Your SSL/TLS should support TLS 1.2 MFLN to limit buffer to 1024 bytes. If MFLN is not supported, it will still work well, as long as the server does not send any message above 1024 bytes (which should be ok, since Tasmota cannot parse MQTT messages above 1024 bytes)
----------- -----------
@ -53,7 +53,7 @@ The main limitations are:
Arduino Core switched form AxTLS to BearSSL in 2.4.2 allowing to optimize further the TLS library footprint. BearSSL is designed for compactness both in code size and memory requirements. Furthermore it is modular and allows to embe only the code necessary for the subset of crypto-algorithms you want to support. Arduino Core switched form AxTLS to BearSSL in 2.4.2 allowing to optimize further the TLS library footprint. BearSSL is designed for compactness both in code size and memory requirements. Furthermore it is modular and allows to embe only the code necessary for the subset of crypto-algorithms you want to support.
Thanks to BearSSL compactness and aggressive optimization, the minimal TLS configuration requires **34.5k of Flash** and **6.7k of Memory**. The full blown AWS IoT version with full certificate validation requires 48.3k of Flash and 9.4k of Memory. Thanks to BearSSL compactness and aggressive optimization, the minimal TLS configuration requires **34.5k of Flash** and **6.7k of Memory**. The full-blown AWS IoT version with full certificate validation requires 48.3k of Flash and 9.4k of Memory.
Here are the tips and tricks used to reduce Flash and Memory: Here are the tips and tricks used to reduce Flash and Memory: