"While adding MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME restores the previous behavior and ensures compatibility after the mbedtls upgrade, it globally disables hostname verification for all DTLS client connections. This is a significant security weakening, as it makes connections vulnerable to machine-in-the-middle (MITM) attacks if an attacker can obtain a valid certificate for a different hostname.
The more secure, long-term solution is to update the client-side code to set the expected hostname for verification using mbedtls_ssl_set_hostname(). This would involve modifying DtlsSession to accept a hostname and apply it to the mbedtls_ssl_context.
If this change is intended as a temporary workaround, I recommend creating a follow-up issue to track the implementation of proper hostname verification.
Based on the Gemini review comment for PR #326 , we need to implement subsequent improvements after upgrading the mbedTLS submodule to version 3.6.4.