mbedTLS is mostly nice but it does suffer from some poor coding practices like large buffers allocated on the stack.

I would warn anyone to stay away from Cypress/Broadcom's WICED OS which has a modified version of mbedTLS with foolish changes to the API that makes porting code extremely challenging.