Mbed TLS is a C library that implements X.509 certificate manipulation and the TLS and DTLS protocols. Its small code footprint makes it suitable for embedded systems. Mbed TLS includes the TF-PSA-Crypto repository that provides an implementation of the PSA Cryptography API.

Configuration options related to X.509 and TLS are available in include/mbedtls/mbedtls_config.h, while cryptography and platform options are located in the TF-PSA-Crypto configuration file tf-psa-crypto/include/psa/crypto_config.h.

With the default platform options, Mbed TLS should build out of the box on most systems.

These configuration files can be edited manually, or programmatically using the Python script scripts/config.py (run with --help for usage instructions).

We provide some non-standard configurations focused on specific use cases in the configs/ directory. You can read more about those in configs/README.txt.

The main Mbed TLS documentation is available via ReadTheDocs.

To generate a local copy of the library documentation in HTML format, tailored to your compile-time configuration:

1. Make sure that Doxygen is installed.
2. Run cmake -B /path/to/build_dir /path/to/mbedtls/source
3. Run cmake --build /path/to/build_dir --target mbedtls-apidoc
4. Open one of the main generated HTML files:
   • apidoc/index.html
   • apidoc/modules.html or apidoc/topics.html

For other sources of documentation, see the SUPPORT document.

We use CMake to configure and drive our build process. Three libraries are built: libtfpsacrypto, libmbedx509, and libmbedtls. Note that libmbedtls depends on libmbedx509 and libtfpsacrypto, and libmbedx509 depends on libtfpsacrypto. As a result, some linkers will expect flags to be in a specific order, for example the GNU linker wants -lmbedtls -lmbedx509 -ltfpsacrypto. The cryptographic library libtfpsacrypto is also provided under its legacy name, libmbedcrypto.

You need the following tools to build the library from the main branch with the provided CMake files. Mbed TLS minimum tool version requirements are set based on the versions shipped in the latest or penultimate (depending on the release cadence) long-term support releases of major Linux distributions, namely at time of writing: Ubuntu 22.04, RHEL 9, and SLES 15 SP4.