diff --git a/cores/esp8266/WString.cpp b/cores/esp8266/WString.cpp
index 26825266a..331b2a540 100644
--- a/cores/esp8266/WString.cpp
+++ b/cores/esp8266/WString.cpp
@@ -260,7 +260,8 @@ String &String::copy(const char *cstr, unsigned int length) {
         return *this;
     }
     setLen(length);
-    memmove_P(wbuffer(), cstr, length + 1);
+    memmove_P(wbuffer(), cstr, length);
+    wbuffer()[length] = 0;
     return *this;
 }
 
@@ -270,7 +271,8 @@ String &String::copy(const __FlashStringHelper *pstr, unsigned int length) {
         return *this;
     }
     setLen(length);
-    memcpy_P(wbuffer(), (PGM_P)pstr, length + 1); // We know wbuffer() cannot ever be in PROGMEM, so memcpy safe here
+    memcpy_P(wbuffer(), (PGM_P)pstr, length); // We know wbuffer() cannot ever be in PROGMEM, so memcpy safe here
+    wbuffer()[length] = 0;
     return *this;
 }
 
@@ -411,8 +413,9 @@ bool String::concat(const __FlashStringHelper *str) {
     unsigned int newlen = len() + length;
     if (!reserve(newlen))
         return false;
-    memcpy_P(wbuffer() + len(), (PGM_P)str, length + 1);
+    memcpy_P(wbuffer() + len(), (PGM_P)str, length);
     setLen(newlen);
+    wbuffer()[newlen] = 0;
     return true;
 }
 
diff --git a/cores/esp8266/uart.cpp b/cores/esp8266/uart.cpp
index 1f657c940..802072d43 100644
--- a/cores/esp8266/uart.cpp
+++ b/cores/esp8266/uart.cpp
@@ -696,7 +696,7 @@ uart_init(int uart_nr, int baudrate, int config, int mode, int tx_pin, size_t rx
     }
 
     uart_set_baudrate(uart, baudrate);
-    if(uart->uart_nr == UART0 && invert)
+    if((uart->uart_nr == UART0 || uart->uart_nr == UART1) && invert)
     {
         config |= BIT(UCDTRI) | BIT(UCRTSI) | BIT(UCTXI) | BIT(UCDSRI) | BIT(UCCTSI) | BIT(UCRXI);
     }
diff --git a/libraries/ESP8266WebServer/src/Parsing-impl.h b/libraries/ESP8266WebServer/src/Parsing-impl.h
index 8e4a6d1ae..83762a03c 100644
--- a/libraries/ESP8266WebServer/src/Parsing-impl.h
+++ b/libraries/ESP8266WebServer/src/Parsing-impl.h
@@ -182,7 +182,7 @@ typename ESP8266WebServerTemplate<ServerType>::ClientFuture ESP8266WebServerTemp
     if (!isForm) {
       if (contentLength) {
         // add key=value: plain={body} (post json or other data)
-        RequestArgument& arg = _currentArgs[_currentArgCount++];
+        RequestArgument& arg = _currentArgs[_currentArgCount];
         arg.key = F("plain");
         arg.value = plainBuf;
         _currentArgsHavePlain = 1;
diff --git a/tools/sdk/include/bearssl/bearssl.h b/tools/sdk/include/bearssl/bearssl.h
index 4f4797cf7..310edb258 100644
--- a/tools/sdk/include/bearssl/bearssl.h
+++ b/tools/sdk/include/bearssl/bearssl.h
@@ -137,6 +137,10 @@
 #include "bearssl_x509.h"
 #include "bearssl_pem.h"
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /** \brief Type for a configuration option.
  *
  * A "configuration option" is a value that is selected when the BearSSL
@@ -167,4 +171,13 @@ typedef struct {
  */
 const br_config_option *br_get_config(void);
 
+/* ======================================================================= */
+
+/** \brief Version feature: support for time callback. */
+#define BR_FEATURE_X509_TIME_CALLBACK   1
+
+#ifdef __cplusplus
+}
+#endif
+
 #endif
diff --git a/tools/sdk/include/bearssl/bearssl_git.h b/tools/sdk/include/bearssl/bearssl_git.h
index 9ee190413..7ee5c370f 100644
--- a/tools/sdk/include/bearssl/bearssl_git.h
+++ b/tools/sdk/include/bearssl/bearssl_git.h
@@ -1,2 +1,2 @@
 // Do not edit -- Automatically generated by tools/sdk/ssl/bearssl/Makefile
-#define BEARSSL_GIT 6105635
+#define BEARSSL_GIT 9fe3977
diff --git a/tools/sdk/include/bearssl/bearssl_x509.h b/tools/sdk/include/bearssl/bearssl_x509.h
index f2f6e6f87..9a1e6593e 100644
--- a/tools/sdk/include/bearssl/bearssl_x509.h
+++ b/tools/sdk/include/bearssl/bearssl_x509.h
@@ -625,6 +625,52 @@ typedef struct {
 
 } br_name_element;
 
+/**
+ * \brief Callback for validity date checks.
+ *
+ * The function receives as parameter an arbitrary user-provided context,
+ * and the notBefore and notAfter dates specified in an X.509 certificate,
+ * both expressed as a number of days and a number of seconds:
+ *
+ *   - Days are counted in a proleptic Gregorian calendar since
+ *     January 1st, 0 AD. Year "0 AD" is the one that preceded "1 AD";
+ *     it is also traditionally known as "1 BC".
+ *
+ *   - Seconds are counted since midnight, from 0 to 86400 (a count of
+ *     86400 is possible only if a leap second happened).
+ *
+ * Each date and time is understood in the UTC time zone. The "Unix
+ * Epoch" (January 1st, 1970, 00:00 UTC) corresponds to days=719528 and
+ * seconds=0; the "Windows Epoch" (January 1st, 1601, 00:00 UTC) is
+ * days=584754, seconds=0.
+ *
+ * This function must return -1 if the current date is strictly before
+ * the "notBefore" time, or +1 if the current date is strictly after the
+ * "notAfter" time. If neither condition holds, then the function returns
+ * 0, which means that the current date falls within the validity range of
+ * the certificate. If the function returns a value distinct from -1, 0
+ * and +1, then this is interpreted as an unavailability of the current
+ * time, which normally ends the validation process with a
+ * `BR_ERR_X509_TIME_UNKNOWN` error.
+ *
+ * During path validation, this callback will be invoked for each
+ * considered X.509 certificate. Validation fails if any of the calls
+ * returns a non-zero value.
+ *
+ * The context value is an abritrary pointer set by the caller when
+ * configuring this callback.
+ *
+ * \param tctx                 context pointer.
+ * \param not_before_days      notBefore date (days since Jan 1st, 0 AD).
+ * \param not_before_seconds   notBefore time (seconds, at most 86400).
+ * \param not_after_days       notAfter date (days since Jan 1st, 0 AD).
+ * \param not_after_seconds    notAfter time (seconds, at most 86400).
+ * \return  -1, 0 or +1.
+ */
+typedef int (*br_x509_time_check)(void *tctx,
+	uint32_t not_before_days, uint32_t not_before_seconds,
+	uint32_t not_after_days, uint32_t not_after_seconds);
+
 /**
  * \brief The "minimal" X.509 engine structure.
  *
@@ -647,8 +693,8 @@ typedef struct {
 		uint32_t *rp;
 		const unsigned char *ip;
 	} cpu;
-	uint32_t dp_stack[32];
-	uint32_t rp_stack[32];
+	uint32_t dp_stack[31];
+	uint32_t rp_stack[31];
 	int err;
 
 	/* Server name to match with the SAN / CN of the EE certificate. */
@@ -730,6 +776,12 @@ typedef struct {
 	br_name_element *name_elts;
 	size_t num_name_elts;
 
+	/*
+	 * Callback function (and context) to get the current date.
+	 */
+	void *itime_ctx;
+	br_x509_time_check itime;
+
 	/*
 	 * Public key cryptography implementations (signature verification).
 	 */
@@ -890,7 +942,10 @@ void br_x509_minimal_init_full(br_x509_minimal_context *ctx,
  *   - Seconds are counted since midnight, from 0 to 86400 (a count of
  *     86400 is possible only if a leap second happened).
  *
- * The validation date and time is understood in the UTC time zone.
+ * The validation date and time is understood in the UTC time zone. The
+ * "Unix Epoch" (January 1st, 1970, 00:00 UTC) corresponds to days=719528
+ * and seconds=0; the "Windows Epoch" (January 1st, 1601, 00:00 UTC) is
+ * days=584754, seconds=0.
  *
  * If the validation date and time are not explicitly set, but BearSSL
  * was compiled with support for the system clock on the underlying
@@ -908,6 +963,28 @@ br_x509_minimal_set_time(br_x509_minimal_context *ctx,
 {
 	ctx->days = days;
 	ctx->seconds = seconds;
+	ctx->itime = 0;
+}
+
+/**
+ * \brief Set the validity range callback function for the X.509
+ * "minimal" engine.
+ *
+ * The provided function will be invoked to check whether the validation
+ * date is within the validity range for a given X.509 certificate; a
+ * call will be issued for each considered certificate. The provided
+ * context pointer (itime_ctx) will be passed as first parameter to the
+ * callback.
+ *
+ * \param tctx   context for callback invocation.
+ * \param cb     callback function.
+ */
+static inline void
+br_x509_minimal_set_time_callback(br_x509_minimal_context *ctx,
+	void *itime_ctx, br_x509_time_check itime)
+{
+	ctx->itime_ctx = itime_ctx;
+	ctx->itime = itime;
 }
 
 /**
diff --git a/tools/sdk/lib/libbearssl.a b/tools/sdk/lib/libbearssl.a
index 58e8d80c5..d1b89a80d 100644
Binary files a/tools/sdk/lib/libbearssl.a and b/tools/sdk/lib/libbearssl.a differ
diff --git a/tools/sdk/lib/liblwip2-1460-feat.a b/tools/sdk/lib/liblwip2-1460-feat.a
index 3ed56d2c2..332e8d5e3 100644
Binary files a/tools/sdk/lib/liblwip2-1460-feat.a and b/tools/sdk/lib/liblwip2-1460-feat.a differ
diff --git a/tools/sdk/lib/liblwip2-1460.a b/tools/sdk/lib/liblwip2-1460.a
index 7de7faded..2d34e9fa4 100644
Binary files a/tools/sdk/lib/liblwip2-1460.a and b/tools/sdk/lib/liblwip2-1460.a differ
diff --git a/tools/sdk/lib/liblwip2-536-feat.a b/tools/sdk/lib/liblwip2-536-feat.a
index 556e86425..819293bfd 100644
Binary files a/tools/sdk/lib/liblwip2-536-feat.a and b/tools/sdk/lib/liblwip2-536-feat.a differ
diff --git a/tools/sdk/lib/liblwip2-536.a b/tools/sdk/lib/liblwip2-536.a
index f9ece4cea..28eb3ecd2 100644
Binary files a/tools/sdk/lib/liblwip2-536.a and b/tools/sdk/lib/liblwip2-536.a differ
diff --git a/tools/sdk/lib/liblwip6-1460-feat.a b/tools/sdk/lib/liblwip6-1460-feat.a
index f50d97d2a..efb5d24dc 100644
Binary files a/tools/sdk/lib/liblwip6-1460-feat.a and b/tools/sdk/lib/liblwip6-1460-feat.a differ
diff --git a/tools/sdk/lib/liblwip6-536-feat.a b/tools/sdk/lib/liblwip6-536-feat.a
index fae815211..f4a2a7ecb 100644
Binary files a/tools/sdk/lib/liblwip6-536-feat.a and b/tools/sdk/lib/liblwip6-536-feat.a differ
diff --git a/tools/sdk/lwip2/builder b/tools/sdk/lwip2/builder
index 66f84a603..b5def382d 160000
--- a/tools/sdk/lwip2/builder
+++ b/tools/sdk/lwip2/builder
@@ -1 +1 @@
-Subproject commit 66f84a603ee3070467f119b5e2be5209ec22351f
+Subproject commit b5def382d6ec666dc423611d09f137aa45147f25
diff --git a/tools/sdk/lwip2/include/lwip-git-hash.h b/tools/sdk/lwip2/include/lwip-git-hash.h
index fe8698cbf..f5e25bf23 100644
--- a/tools/sdk/lwip2/include/lwip-git-hash.h
+++ b/tools/sdk/lwip2/include/lwip-git-hash.h
@@ -1,5 +1,5 @@
 // generated by makefiles/make-lwip2-hash
 #ifndef LWIP_HASH_H
 #define LWIP_HASH_H
-#define LWIP_HASH_STR "STABLE-2_1_3_RELEASE/glue:1.2-61-g679577b"
+#define LWIP_HASH_STR "STABLE-2_1_3_RELEASE/glue:1.2-63-gb5def38"
 #endif // LWIP_HASH_H
diff --git a/tools/sdk/lwip2/include/lwip/arch.h b/tools/sdk/lwip2/include/lwip/arch.h
index 16add8982..58dae33aa 100644
--- a/tools/sdk/lwip2/include/lwip/arch.h
+++ b/tools/sdk/lwip2/include/lwip/arch.h
@@ -190,7 +190,7 @@ typedef uintptr_t mem_ptr_t;
  * sys/types or unistd.h are available).
  * Being like that, we define it to 'int' if SSIZE_MAX is not defined.
  */
-#if !defined(SSIZE_MAX) || !defined(_SSIZE_T_DECLARED)
+#ifdef SSIZE_MAX
 /* If SSIZE_MAX is defined, unistd.h should provide the type as well */
 #ifndef LWIP_NO_UNISTD_H
 #define LWIP_NO_UNISTD_H 0
diff --git a/tools/sdk/ssl/bearssl b/tools/sdk/ssl/bearssl
index 610563553..9fe3977fc 160000
--- a/tools/sdk/ssl/bearssl
+++ b/tools/sdk/ssl/bearssl
@@ -1 +1 @@
-Subproject commit 6105635531027f5b298aa656d44be2289b2d434f
+Subproject commit 9fe3977fc33d2a0dc6d26fd4bdec054d5cb889d3
diff --git a/tools/upload.py b/tools/upload.py
index 2b7016cc9..29819e537 100755
--- a/tools/upload.py
+++ b/tools/upload.py
@@ -6,17 +6,17 @@
 # First parameter is pyserial path, second is esptool path, then a series of command arguments
 # i.e. upload.py tools/pyserial tools/esptool write_flash file 0x0
 
-import sys
 import os
+import sys
 import tempfile
 
 sys.argv.pop(0) # Remove executable name
-toolspath = os.path.dirname(os.path.realpath(__file__)).replace('\\', '/') # CWD in UNIX format
+toolspath = os.path.dirname(os.path.realpath(__file__))
 try:
-    sys.path.insert(0, toolspath + "/pyserial") # Add pyserial dir to search path
-    sys.path.insert(0, toolspath + "/esptool") # Add esptool dir to search path
+    sys.path.insert(0, os.path.join(toolspath, "pyserial")) # Add pyserial dir to search path
+    sys.path.insert(0, os.path.join(toolspath, "esptool")) # Add esptool dir to search path
     import esptool # If this fails, we can't continue and will bomb below
-except Exception:
+except ImportError:
     sys.stderr.write("pyserial or esptool directories not found next to this upload.py tool.\n")
     sys.exit(1)
 
@@ -26,7 +26,7 @@ write_addr = '0x0'
 erase_addr = ''
 erase_len = ''
 
-while len(sys.argv):
+while sys.argv:
     thisarg = sys.argv.pop(0)
 
     # We silently replace the 921kbaud setting with 460k to enable backward
@@ -45,25 +45,30 @@ while len(sys.argv):
     elif thisarg == 'write_flash':
         write_addr = sys.argv.pop(0)
         binary = sys.argv.pop(0)
-    elif len(thisarg):
+    elif thisarg:
         cmdline = cmdline + [thisarg]
 
 cmdline = cmdline + ['write_flash']
-if len(write_option):
+if write_option:
     cmdline = cmdline + [write_option]
 cmdline = cmdline + ['--flash_size', 'detect']
 cmdline = cmdline + [write_addr, binary]
 
 erase_file = ''
-if len(erase_addr):
+if erase_addr:
     # Generate temporary empty (0xff) file
     eraser = tempfile.mkstemp()
     erase_file = eraser[1]
-    os.write(eraser[0], bytearray([255] * int(erase_len, 0)))
+    os.write(eraser[0], bytearray([0xff] * int(erase_len, 0)))
     os.close(eraser[0])
-    cmdline = cmdline + [ erase_addr, erase_file ]
+    cmdline = cmdline + [erase_addr, erase_file]
 
-esptool.main(cmdline)
-
-if len(erase_file):
-    os.remove(erase_file)
+try:
+    esptool.main(cmdline)
+except esptool.FatalError as e:
+    sys.stderr.write('\nA fatal esptool.py error occurred: %s' % e)
+finally:
+    if erase_file:
+        os.remove(erase_file)
+    if sys.exc_info:
+        sys.exit(2)