From 9ce37bf3a55b7867bdc3a1ebe91382961386c539 Mon Sep 17 00:00:00 2001
From: Udi Tirosh <udijw@yahoo.com>
Date: Sat, 22 Aug 2026 13:36:28 +0300
Subject: [PATCH 1/2] ESP32: add missing setInsecure() to SecuredEsp32TcpClient

SecuredEsp32TcpClient exposes setCACert(), setCertificate() and
setPrivateKey(), but has no setInsecure() -- even though the underlying
WiFiClientSecure provides one.

upgradeToSecuredConnection() is written as though the method exists. Because
it does not, there is no way to reach WiFiClientSecure::setInsecure() through
this class, and a client that asks for an insecure connection never gets one.
The TLS handshake then fails with no diagnostic.
---
 src/tiny_websockets/network/esp32/esp32_tcp.hpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/tiny_websockets/network/esp32/esp32_tcp.hpp b/src/tiny_websockets/network/esp32/esp32_tcp.hpp
index b10820c..e8bd5fa 100644
--- a/src/tiny_websockets/network/esp32/esp32_tcp.hpp
+++ b/src/tiny_websockets/network/esp32/esp32_tcp.hpp
@@ -16,6 +16,10 @@ namespace websockets { namespace network {
   
   class SecuredEsp32TcpClient : public GenericEspTcpClient<WiFiClientSecure> {
   public:
+    void setInsecure() {
+      this->client.setInsecure();
+    }
+
     void setCACert(const char* ca_cert) {
       this->client.setCACert(ca_cert);
     }

From cb9ea310119ff7a659b709d1364279395e4089a8 Mon Sep 17 00:00:00 2001
From: Udi Tirosh <udijw@yahoo.com>
Date: Sat, 22 Aug 2026 13:55:17 +0300
Subject: [PATCH 2/2] ESP32: fall back to insecure when no TLS credentials are
 configured

The ESP8266 branch of upgradeToSecuredConnection() ends in an else that calls
setInsecure() when the caller supplied no fingerprint, trust anchors or client
certificate. The ESP32 branch has no such fallback.

The result is that on ESP32, calling WebsocketsClient::setInsecure() and then
connect() to a wss:// endpoint leaves WiFiClientSecure in its default
certificate-verification mode with no CA bundle loaded. Verification cannot
succeed, so the handshake fails.

It fails silently: connect() returns false with no message, no onEvent
callback and nothing on the serial console, so it presents as a network or
credentials problem rather than a library one. See issues #120, #101 and #152.

This mirrors the existing ESP8266 behaviour rather than introducing new
policy, and only takes effect when no credentials were supplied -- the
CA cert, client certificate and private key paths are unchanged.
---
 src/websockets_client.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/websockets_client.cpp b/src/websockets_client.cpp
index f72a14a..b22faa6 100644
--- a/src/websockets_client.cpp
+++ b/src/websockets_client.cpp
@@ -230,6 +230,8 @@ namespace websockets {
         }
         if(this->_optional_ssl_private_key) {
             client->setPrivateKey(this->_optional_ssl_private_key);
+        } else {
+            client->setInsecure();
         }
     #endif