skills.rest
JasonYANG170
JasonYANG170COMMUNITY
Explore all skills by this author →
WebsiteGitHub

mbedtls-skill

Generates Mbed TLS 4.x TLS/DTLS client, server, and X.509 certificate code.

28|3|Updated Jun 24, 2026
Search Tags:#c#tls#x509#dtls#embedded security#mbedtls#psa crypto
One-click install
npx skills add https://github.com/JasonYANG170/esp-dev-skill --skill mbedtls-skill-jasonyang170
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mbedtls-skill
Source: https://github.com/JasonYANG170/esp-dev-skill/tree/main/repos/mbedtls
Command: npx skills add https://github.com/JasonYANG170/esp-dev-skill --skill mbedtls-skill-jasonyang170

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Writing correct Mbed TLS 4.x code is error-prone: the 4.x release removed manual RNG, renamed key APIs, split configuration across two files, and requires PSA Crypto initialization before any cryptographic operation. This Skill provides verified recipes, API references, and migration guidance so generated TLS/DTLS and X.509 code compiles and behaves correctly. ## Core Features & Use Cases - TLS/DTLS Clients and Servers: Complete call chains for handshake, read/write, session resumption, PSK authentication, DTLS timers, and HelloVerify cookies. - X.509 Operations: Parse and verify certificate chains, generate CSRs, and sign certificates with correct 4.x APIs. - 3.x to 4.x Migration: Replace removed entropy/ctr_drbg code with psa_crypto_init, update renamed APIs, and move crypto configuration to PSA_WANT_* macros. - Use Case: Ask for a DTLS server with cookie-based DoS protection, and receive code with the required timer callbacks, recv_timeout BIO, and client transport ID handling. ## Quick Start Ask the AI to write an Mbed TLS 4.x TLS client that connects to a server, verifies its certificate against a CA chain, and sends an HTTPS request.

Frequently Asked Questions about mbedtls-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a TLS client with Mbed TLS 4.x?▼

Call psa_crypto_init first, then initialize the SSL context, parse the CA certificate, connect with mbedtls_net_connect, apply config_defaults as a STREAM client, set the CA chain and hostname, and run the handshake loop handling WANT_READ and WANT_WRITE. The Skill provides the full verified call chain.

How do I migrate Mbed TLS 3.x code to 4.x?▼

Remove all entropy and ctr_drbg code plus mbedtls_ssl_conf_rng, and call psa_crypto_init before any crypto operation. Replace renamed APIs like conf_min_version with conf_min_tls_version, conf_curves with conf_groups, and move crypto configuration macros to PSA_WANT_* in crypto_config.h.

Why does my Mbed TLS DTLS handshake hang?▼

DTLS requires a recv_timeout BIO callback and a timer callback bound via mbedtls_ssl_set_timer_cb with mbedtls_timing_set_delay and get_delay. Without these, the retransmission state machine cannot run and the handshake stalls.

Does Mbed TLS 4.x still support mbedtls_ssl_conf_rng?▼

No. Mbed TLS 4.x removed mbedtls_ssl_conf_rng along with the entropy and ctr_drbg modules. All randomness comes from the PSA Crypto subsystem, so you only need to call psa_crypto_init once at program start.

Why does the second client fail to handshake on my Mbed TLS server?▼

The SSL context must be reset between connections. Call mbedtls_net_free on the old client fd, then mbedtls_ssl_session_reset before accepting the next client, otherwise the second handshake fails.

Can I build Mbed TLS 4.x with Make?▼

No. Mbed TLS 4.x supports only CMake (version 3.20.2 or newer); Make and Visual Studio projects were removed. Link libraries in the order -lmbedtls -lmbedx509 -ltfpsacrypto.

Related Skills

Explore More Software Engineering Skills→
awfixers-stuffawfixers-stuff

cmake

Define modern CMake workflows for C/C++ projects with target-centric design.

Official
Advanced
lordmaculordmacu
6

Endpoint Check

Validate HTTP endpoints for status, latency, and TLS certificate details.

Community
Basic
WhaleylawWhaleylaw

ssl-certificate-specialist

Diagnose and fix SSL/TLS certificate issues across domains and servers.

Community
Advanced
PandaalaPandaala

gateway-tls-overview

Maps Edgion Gateway TLS termination and upstream TLS behavior to TLS store and SNI matchers.

Official
Advanced