mbedtls-integration
starsforks
How to install mbedtls-integration?
easyzoom/aix-skills/mbedtls-integration
$npx -y skills add easyzoom/aix-skills --skill mbedtls-integrationUse when integrating, porting, configuring, or debugging mbedTLS on MCU projects, TLS handshakes, certificates, entropy, RNG, memory, or secure embedded transports
SKILL.md
| 1 | # mbedTLS Integration |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | Use this skill to integrate mbedTLS on embedded targets by proving entropy/RNG, time, certificate storage, transport I/O, and memory configuration before debugging application protocols. TLS failures often come from platform hooks rather than cryptography logic. |
| 6 | |
| 7 | ## When To Use |
| 8 | |
| 9 | Use this skill when: |
| 10 | |
| 11 | - The user wants TLS, HTTPS, MQTT over TLS, DTLS, X.509, crypto, or secure boot-related primitives using mbedTLS. |
| 12 | - The issue involves handshake failure, certificate validation, entropy source, RNG, memory allocation, time validity, or socket callbacks. |
| 13 | - The target is resource-constrained or has hardware crypto/TRNG. |
| 14 | |
| 15 | Do not use this skill for generic networking before TCP/IP works. Use `lwip-integration` first when connectivity is unproven. For lightweight ECC-only operations, use `micro-ecc-integration` or `tinycrypt-integration`. |
| 16 | |
| 17 | ## First Questions |
| 18 | |
| 19 | Ask for: |
| 20 | |
| 21 | - mbedTLS version, target MCU/RTOS, compiler, and network stack. |
| 22 | - Use case: TLS client, TLS server, DTLS, crypto only, MQTT TLS, HTTPS, or certificate parsing. |
| 23 | - `mbedtls_config.h`, enabled features, heap/static allocation policy, and hardware crypto use. |
| 24 | - Entropy/RNG source and time source. |
| 25 | - Certificate chain model, CA storage, SNI/hostname verification, and current error code. |
| 26 | |
| 27 | ## Integration Checklist |
| 28 | |
| 29 | 1. Prove entropy and RNG. |
| 30 | TLS requires a real entropy source. Do not ship deterministic test entropy. |
| 31 | |
| 32 | 1. Configure time. |
| 33 | Certificate validation needs valid time or an explicit product policy for time-less validation. |
| 34 | |
| 35 | 1. Bound memory. |
| 36 | Configure record size, heap, I/O buffers, certificate features, and algorithms for MCU limits. |
| 37 | |
| 38 | 1. Connect transport callbacks. |
| 39 | Network send/recv callbacks must handle non-blocking, timeout, and partial I/O correctly. |
| 40 | |
| 41 | 1. Validate certificates. |
| 42 | Use CA chain, hostname/SNI, and expected verification policy. Do not disable verification silently. |
| 43 | |
| 44 | 1. Decode error codes. |
| 45 | Convert negative mbedTLS errors to readable names before guessing. |
| 46 | |
| 47 | ## Common Failures |
| 48 | |
| 49 | - Handshake fails because time is unset. |
| 50 | - Certificate verification is disabled to "make it work". |
| 51 | - Entropy source is weak or not initialized. |
| 52 | - Heap is too small for certificate chain or record buffers. |
| 53 | - Socket callbacks treat timeout as fatal or ignore partial writes. |
| 54 | - SNI hostname does not match broker/server certificate. |
| 55 | |
| 56 | ## Verification |
| 57 | |
| 58 | Before claiming mbedTLS works: |
| 59 | |
| 60 | - State use case, mbedTLS version, entropy source, time source, and memory policy. |
| 61 | - Confirm a handshake to the target server with certificate verification enabled, unless explicitly out of scope. |
| 62 | - Report decoded error codes for failures. |
| 63 | - Confirm secrets, private keys, and certificates are not logged. |
| 64 | - Confirm memory usage fits the target. |
| 65 | |
| 66 | ## Example |
| 67 | |
| 68 | User: |
| 69 | |
| 70 | ```text |
| 71 | MQTT 加 mbedTLS 后握手失败。 |
| 72 | ``` |
| 73 | |
| 74 | Agent: |
| 75 | |
| 76 | 1. Asks for mbedTLS error code, config, entropy/time source, broker certificate, SNI, and heap size. |
| 77 | 1. Decodes the error and checks time/certificate verification before MQTT logic. |
| 78 | 1. Verifies TLS connect before MQTT connect. |
People who liked this also viewed
6 picksType
- azure-diagnosticsDebug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deploySkillsJul 2026
- systematic-debuggingUse when encountering any bug, test failure, or unexpected behavior, before proposing fixesSkillsJul 2026
- safe-debugRigor Debug / Rigor Audit skill for deep learning research work. Use when the user pastes a traceback, terminal error, CUDA OOM, checkpoint load failure, shape mismatch, NaN loss symptom, or training SkillsMay 2026
- explore-runRigor Improve / Rigor Explore run leaf skill for bounded exploratory evidence in deep learning research repositories. Use when the researcher explicitly authorizes exploratory runs such as small-subseSkillsMay 2026
- minimal-run-and-auditRigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation SkillsMay 2026
- insforge-debugUse when diagnosing problems in an InsForge project — reactive failures (SDK error object, HTTP 4xx/5xx, gateway timeout 502/503/504, edge function failure or timeout, login/OAuth/auth errors, RLS denSkillsJul 2026
