Treat a disabled TLS sub-option in sdkconfig_options as no request

esphome/components/esp32/__init__.py

@@ -1857,12 +1857,15 @@ def require_mbedtls_ecp() -> None:
 
 
 def require_mbedtls_peer_cert() -> None:
-    """Keep the peer certificate after the TLS handshake (CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)."""
+    """Keep the peer certificate after the TLS handshake (CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE).
+
+    A user sdkconfig_options value takes precedence.
+    """
     _mbedtls_sdkconfig().peer_cert_required = True
 
 
 def require_mbedtls_pkcs7() -> None:
-    """Keep mbedTLS PKCS#7 support (CONFIG_MBEDTLS_PKCS7_C)."""
+    """Keep mbedTLS PKCS#7 support (CONFIG_MBEDTLS_PKCS7_C). A user sdkconfig_options value takes precedence."""
     _mbedtls_sdkconfig().pkcs7_required = True
 
 
@@ -2345,9 +2348,11 @@ _TLS_OPTION_PREFIXES = ("CONFIG_ESP_TLS_", "CONFIG_MBEDTLS_SSL_", "CONFIG_ESP_HT
 
 
 def _user_sdkconfig_wants_tls(options: dict[str, Any]) -> bool:
+    """True when sdkconfig_options turn TLS on or tune something under it; an `n` is never a request."""
     return any(
         (name in _MBEDTLS_TLS_ON_OPTIONS and value == "y")
-        or name.startswith(_TLS_OPTION_PREFIXES)
+        or (name == "CONFIG_MBEDTLS_TLS_DISABLED" and value == "n")
+        or (name.startswith(_TLS_OPTION_PREFIXES) and value != "n")
         for name, value in options.items()
     )
 

tests/component_tests/esp32/config/tls_sdkconfig_peer_cert_n.yaml

@@ -0,0 +1,9 @@
+esphome:
+  name: test
+
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+    sdkconfig_options:
+      CONFIG_MBEDTLS_SSL_KEEP_PEER_CERTIFICATE: n

tests/component_tests/esp32/config/tls_sdkconfig_tls_disabled_n.yaml

@@ -0,0 +1,9 @@
+esphome:
+  name: test
+
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+    sdkconfig_options:
+      CONFIG_MBEDTLS_TLS_DISABLED: n

tests/component_tests/esp32/test_esp32.py

@@ -596,6 +596,14 @@ def test_reconcile_mbedtls_sdkconfig(
         pytest.param(
             "tls_sdkconfig_tls_enabled_n.yaml", True, True, id="raw_tls_enabled_n"
         ),
+        # Disabling a TLS sub-option is not a request either.
+        pytest.param(
+            "tls_sdkconfig_peer_cert_n.yaml", True, True, id="raw_peer_cert_n"
+        ),
+        # CONFIG_MBEDTLS_TLS_DISABLED=n is the IDF 5 way to keep TLS.
+        pytest.param(
+            "tls_sdkconfig_tls_disabled_n.yaml", False, False, id="raw_tls_disabled_n"
+        ),
         # SECURE_SIGNED_APPS selects ECP back on in Kconfig; ESPHome still writes the default.
         pytest.param("signed_ota_ecdsa256_c6.yaml", True, True, id="signed_ota_ecdsa"),
     ],
@@ -610,7 +618,7 @@ def test_tls_disabled_sdkconfig(
     """TLS is compiled out unless a component or a raw sdkconfig option asks for it."""
     generate_main(component_config_path(config_file))
     sdkconfig = CORE.data[KEY_ESP32][KEY_SDKCONFIG_OPTIONS]
-    assert ("CONFIG_MBEDTLS_TLS_DISABLED" in sdkconfig) is tls_off
+    assert (sdkconfig.get("CONFIG_MBEDTLS_TLS_DISABLED") is True) is tls_off
     assert ("CONFIG_MBEDTLS_ECP_C" in sdkconfig) is ecp_off
     assert ("esp-tls" in CORE.data[KEY_ESP32][KEY_EXCLUDE_COMPONENTS]) is tls_off