macOS
Homebrewverified · 100%
brew install mbedtlsprovider-native install command
brew / rank 262
Install mbedtls with Homebrew
Cryptographic & SSL/TLS library. Version 4.2.0 via Homebrew; verified 2026-07-07.
install
Additional install commands
overview
Package summary
Cryptographic & SSL/TLS library
Project links
Commands and aliases
- aead_demo
- cert_app
- cert_req
- cert_write
- crl_app
- crypto_examples
- dtls_client
- dtls_server
- generate_random_uuid
- hmac_demo
- key_ladder_demo
- key_ladder_demo.sh
- load_roots
- metatest
- mini_client
- pem2der
- psa_constant_names
- psa_hash
- query_compile_time_config
- query_included_headers
- req_app
- selftest
- ssl_client1
- ssl_client2
- ssl_context_info
- ssl_fork_server
- ssl_mail_client
- ssl_pthread_server
- ssl_server
- ssl_server2
- strerror
- udp_proxy
history
Project history and usage
Mbed TLS is a portable C TLS, DTLS, X.509, and cryptography library now hosted under TrustedFirmware.org, with TF-PSA-Crypto providing its PSA Crypto implementation.
Project history
TrustedFirmware.org presents Mbed TLS and TF-PSA-Crypto together: Mbed TLS implements TLS, DTLS, and X.509 certificate handling, while TF-PSA-Crypto implements the PSA Cryptography API and related driver interfaces. The licensing documentation records the earlier PolarSSL name and says the project is owned by TrustedFirmware.org.
The official GitHub repository describes the library as open source, portable, readable, flexible, and a reference implementation of the PSA Cryptography API. Current releases are made on a roughly three-to-six-month cadence, with the repository tracking dozens of releases.
Adoption history
Mbed TLS is adopted where TLS and crypto need to fit into small systems. TrustedFirmware.org explicitly notes its small code footprint and names TF-A, TF-M, and OP-TEE among its users, placing it in the embedded firmware and secure software supply chain rather than only in server-side TLS stacks.
How it is used
Package users typically consume Mbed TLS as C libraries and headers plus example utilities. Build-time feature selection is central to its use: the default configuration is `include/mbedtls/mbedtls_config.h`, and PSA crypto mechanisms can be selected in `tf-psa-crypto/include/psa/crypto_config.h` or overridden with compile-time configuration macros.
Why package nerds care
Mbed TLS is important to package maintainers because small compile-time choices alter ABI surface, algorithm availability, footprint, and security posture. Its examples and utilities also make Homebrew-style packages useful for testing certificates, TLS clients, servers, and cryptographic primitives from the shell.
Timeline
- Pre-2015: Project is known as PolarSSL before the Mbed TLS name.
- 2020: Official mailing-list archive references the transition from PolarSSL-era private history to public Git history.
- 2026: TrustedFirmware.org lists Mbed TLS with TF-PSA-Crypto and notes users including TF-A, TF-M, and OP-TEE.
- 2026: GitHub repository lists Mbed TLS 4.1.0 as a latest release.
Related projects
- PolarSSL, TF-PSA-Crypto, PSA Crypto API, Trusted Firmware-A, Trusted Firmware-M, OP-TEE, OpenSSL, wolfSSL
Sources
- https://github.com/Mbed-TLS/mbedtls
- https://mbed-tls.readthedocs.io/en/latest/kb/compiling-and-building/how-do-i-configure-mbedtls/
- https://mbed-tls.readthedocs.io/en/latest/kb/licensing/how-is-mbedtls-protected/
- https://mbed-tls.readthedocs.io/projects/api/en/v4.0.0-beta/api/file/crypto__config_8h/
- https://www.trustedfirmware.org/projects/mbed-tls/
security posture
Risk level: blue
broad file, network, media, or database tool signal.
Risk classifier
blue risk · medium confidence · tool
Why
- broad file, network, media, or database tool signal
Signals
- text:client,server
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
include/mbedtls/mbedtls_config.htf-psa-crypto/include/psa/crypto_config.h
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
aead_demo | executable | indexed executable | Discovered from the local executable index. |
cert_app | executable | indexed executable | Discovered from the local executable index. |
cert_req | executable | indexed executable | Discovered from the local executable index. |
cert_write | executable | indexed executable | Discovered from the local executable index. |
crl_app | executable | indexed executable | Discovered from the local executable index. |
crypto_examples | executable | indexed executable | Discovered from the local executable index. |
dtls_client | executable | indexed executable | Discovered from the local executable index. |
dtls_server | executable | indexed executable | Discovered from the local executable index. |
generate_random_uuid | executable | indexed executable | Discovered from the local executable index. |
hmac_demo | executable | indexed executable | Discovered from the local executable index. |
key_ladder_demo | executable | indexed executable | Discovered from the local executable index. |
key_ladder_demo.sh | executable | indexed executable | Discovered from the local executable index. |
load_roots | executable | indexed executable | Discovered from the local executable index. |
metatest | executable | indexed executable | Discovered from the local executable index. |
mini_client | executable | indexed executable | Discovered from the local executable index. |
pem2der | executable | indexed executable | Discovered from the local executable index. |
psa_constant_names | executable | indexed executable | Discovered from the local executable index. |
psa_hash | executable | indexed executable | Discovered from the local executable index. |
query_compile_time_config | executable | indexed executable | Discovered from the local executable index. |
query_included_headers | executable | indexed executable | Discovered from the local executable index. |
req_app | executable | indexed executable | Discovered from the local executable index. |
selftest | executable | indexed executable | Discovered from the local executable index. |
ssl_client1 | executable | indexed executable | Discovered from the local executable index. |
ssl_client2 | executable | indexed executable | Discovered from the local executable index. |
ssl_context_info | executable | indexed executable | Discovered from the local executable index. |
ssl_fork_server | executable | indexed executable | Discovered from the local executable index. |
ssl_mail_client | executable | indexed executable | Discovered from the local executable index. |
ssl_pthread_server | executable | indexed executable | Discovered from the local executable index. |
ssl_server | executable | indexed executable | Discovered from the local executable index. |
ssl_server2 | executable | indexed executable | Discovered from the local executable index. |
strerror | executable | indexed executable | Discovered from the local executable index. |
udp_proxy | executable | indexed executable | Discovered from the local executable index. |
zeroize | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version4.2.0
manager updated2026-07-07
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:mbedtls |
|---|---|
| Version | 4.2.0 |
| Package manager | Homebrew |
| Homepage | https://www.trustedfirmware.org/projects/mbed-tls/ |
| Repository | https://github.com/Mbed-TLS/mbedtls |
| Last updated | 2026-07-07T16:39:09Z |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation