Unclear usage of Session Tickets in TLS 1.3
Posted: Wed Jul 22, 2026 9:00 am
Dear Espressif forum,
I am working on the ESP-IDF 5.4.0 on a Ubuntu 24.04.
While working to enable a MQTT client that uses TLS 1.3 I have ran into an issue.
I want to use Session Tickets to reduce my network overhead as my use case involves unpredictable network stability so having session tickets would greatly reduce my network usage. I've read that the TLS 1.3 protocol is better equipped for this than the TLS 1.2 protocol and while making the switch I have gotten build errors.
When using menu config I tried setting the following:
MBEDTLS_SSL_PROTO_TLS1_2 = n
MBEDTLS_SSL_PROTO_TLS1_3 = y
Everything else was as was the same as in the official MQTT example code.
After building I have gotten this error:
Upon closer inspection I had these configs still on:
MBEDTLS_CLIENT_SSL_SESSION_TICKETS = y
ESP_TLS_CLIENT_SESSION_TICKETS = y
Upon disabling ESP_TLS_CLIENT_SESSION_TICKETS, the build error is resolved.
OR
Upon enabling MBEDTLS_SSL_PROTO_TLS1_2, the build error is resolved.
OR
Upon disabling MBEDTLS_CLIENT_SSL_SESSION_TICKETS, the build error is resolved
I learned I can force the TLS version 1.3 to my MQTT client using this github issue:
https://github.com/espressif/esp-idf/is ... 222350424
And I see that an API for reusing session tickets for MQTT over TLS will be added soon:
https://github.com/espressif/esp-mqtt/i ... 4294209994
But I'm confused as to if I enable MBEDTLS_SSL_PROTO_TLS1_2 or disable ESP_TLS_CLIENT_SESSION_TICKETS or disable MBEDTLS_CLIENT_SSL_SESSION_TICKETS, will I be able to use the Session ticket feature of the TLS 1.3? Do I have to have TLS 1.2 enabled but force the usage of TLS 1.3 as seen in github issues above. Can I disable ESP_TLS_CLIENT_SESSION_TICKETS and MBEDTLS_CLIENT_SSL_SESSION_TICKETS and MBEDTLS_SSL_PROTO_TLS1_2 and still use TLS 1.3 with my MQTT client and use the solution in https://github.com/espressif/esp-mqtt/i ... 4294209994 to reuse my session ticket?
Or should I stick with TLS 1.2 until an official solution is presented?
Is the RFC 5077 session tickets only used in TLS 1.2 and using the Session Tickets is not correct if I want to use TLS 1.3?
Thank you for your time.
I am working on the ESP-IDF 5.4.0 on a Ubuntu 24.04.
While working to enable a MQTT client that uses TLS 1.3 I have ran into an issue.
I want to use Session Tickets to reduce my network overhead as my use case involves unpredictable network stability so having session tickets would greatly reduce my network usage. I've read that the TLS 1.3 protocol is better equipped for this than the TLS 1.2 protocol and while making the switch I have gotten build errors.
When using menu config I tried setting the following:
MBEDTLS_SSL_PROTO_TLS1_2 = n
MBEDTLS_SSL_PROTO_TLS1_3 = y
Everything else was as was the same as in the official MQTT example code.
After building I have gotten this error:
Code: Select all
/home/user/esp/v5.4/esp-idf/components/esp-tls/esp_tls_mbedtls.c: In function 'set_client_config':
/home/user/esp/v5.4/esp-idf/components/esp-tls/esp_tls_mbedtls.c:749:5: error: implicit declaration of function 'mbedtls_ssl_conf_renegotiation'; did you mean 'mbedtls_ssl_conf_legacy_renegotiation'? [-Wimplicit-function-declaration]
749 | mbedtls_ssl_conf_renegotiation(&tls->conf, MBEDTLS_SSL_RENEGOTIATION_ENABLED);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| mbedtls_ssl_conf_legacy_renegotiation
[786/1102] Building C object esp-idf/http_parser/CMakeFiles/__idf_http_parser.dir/http_parser.c.obj
ninja: build stopped: subcommand failed.
MBEDTLS_CLIENT_SSL_SESSION_TICKETS = y
ESP_TLS_CLIENT_SESSION_TICKETS = y
Upon disabling ESP_TLS_CLIENT_SESSION_TICKETS, the build error is resolved.
OR
Upon enabling MBEDTLS_SSL_PROTO_TLS1_2, the build error is resolved.
OR
Upon disabling MBEDTLS_CLIENT_SSL_SESSION_TICKETS, the build error is resolved
I learned I can force the TLS version 1.3 to my MQTT client using this github issue:
https://github.com/espressif/esp-idf/is ... 222350424
And I see that an API for reusing session tickets for MQTT over TLS will be added soon:
https://github.com/espressif/esp-mqtt/i ... 4294209994
But I'm confused as to if I enable MBEDTLS_SSL_PROTO_TLS1_2 or disable ESP_TLS_CLIENT_SESSION_TICKETS or disable MBEDTLS_CLIENT_SSL_SESSION_TICKETS, will I be able to use the Session ticket feature of the TLS 1.3? Do I have to have TLS 1.2 enabled but force the usage of TLS 1.3 as seen in github issues above. Can I disable ESP_TLS_CLIENT_SESSION_TICKETS and MBEDTLS_CLIENT_SSL_SESSION_TICKETS and MBEDTLS_SSL_PROTO_TLS1_2 and still use TLS 1.3 with my MQTT client and use the solution in https://github.com/espressif/esp-mqtt/i ... 4294209994 to reuse my session ticket?
Or should I stick with TLS 1.2 until an official solution is presented?
Is the RFC 5077 session tickets only used in TLS 1.2 and using the Session Tickets is not correct if I want to use TLS 1.3?
Thank you for your time.