Unable to change MBEDTLS_CFG_FILE in NCS 3.2

RE: Unable to change MBEDTLS_CFG_FILE in NCS 3.2

timonsku — Thu, 05 Mar 2026 18:00:30 GMT

Thanks for clarifying, thats what I figured after reading further into the upstream Zephyr plans on this and what happened in mbed TLS itself. It wasn't quite clear that only portions of mbed TLS has changed upstream and that this reflects those changes by the upstream project.
When I read "crypto APIs" in my head that extended to just refer to "mbed TLS" as in the past it was just "the crypto library" in projects.
I was able to resolve not being able to set the custom header. There was another config (CONFIG_MBEDTLS_BUILTIN) set to =y elsewhere that was a dependency of =n in order to be able to set a custom config

RE: Unable to change MBEDTLS_CFG_FILE in NCS 3.2

Einar Thorsrud — Thu, 05 Mar 2026 07:26:46 GMT

Hi,

I am sorry for being confusing. It is not that mbed TLS is being removed, but the legacy mbedTLS crypto APIs will be removed. This is removed from mbedTLS itself in mbed TLS 4.0, so as a consequence, support will be removed when we integrate mbed TLS 4.0.

RE: Unable to change MBEDTLS_CFG_FILE in NCS 3.2

timonsku — Thu, 05 Mar 2026 00:28:30 GMT

Especially as mbed TLS seems to still be very much needed. The PSA APIs would not cover X.509 or TLS related functionality. From the mbed TLS project: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/4.0-migration-guide.md
"Mbed TLS has been split between two products: TF-PSA-Crypto for cryptography, and Mbed TLS for X.509 and (D)TLS."
Which means needing to configure mbed TLS is still necessary but right now I get circular dependencies with anything related to setting a custom header file for mbed TLS.

RE: Unable to change MBEDTLS_CFG_FILE in NCS 3.2

timonsku — Wed, 04 Mar 2026 23:41:30 GMT

Just to be clear, when you say legacy mbed TLS crypto APIs that means the entirety of mbed TLS is deprecated?
It is not quite clear from the docs if that just means certain parts of it or all of it. mbed TLS is still around in the SDK and there are not deprecation warnings when you make use of mbed TLS functions so its a bit confusing whether its just unsupported now or going to be fully deprecated.

RE: Unable to change MBEDTLS_CFG_FILE in NCS 3.2

Einar Thorsrud — Wed, 04 Mar 2026 15:11:49 GMT

Hi,

As you note, legacy mbed TLS crypto API's have been deprecated for a while, and will soon be removed. I would strongly advice that you migrate to PSA crypto APIs. Regarding samples you should refer to the crypto samples under nrf. I do not believe we have a specific migration guide for migrating from legacy APIs to PSA crypto APIs, but I suggest referring to the samples to see how PSA crypto is used.