Start with a working TLS connection, then reduce the build to the features your product needs. A smaller build can save flash and RAM, but it must still authenticate the peer and interoperate with your service. The final footprint depends on the target, compiler, enabled algorithms, certificates, and connection buffers. Measure your build rather than relying on a fixed size promise.

Establish a baseline

Build an example with the shipped configuration and your platform's network port. Confirm the expected server name and trust result.
Record flash size, peak RAM during a full handshake, and RAM while exchanging application data. Use your intended certificate chain.
Identify the TLS versions, certificate types, and algorithms your service requires. Changes at the service can affect compatibility.

Reduce one feature at a time

Product requirement	Configuration to review
Device makes outgoing connections only	Keep SHARKSSL_SSL_CLIENT_CODE; consider disabling SHARKSSL_SSL_SERVER_CODE.
No client identity certificate required by the service	Review SHARKSSL_ENABLE_CLIENT_AUTH. Retain server authentication.
Certificates are provisioned as SharkSSL binary data	Review SHARKSSL_ENABLE_PEM_API and SHARKSSL_ENABLE_CERTSTORE_API. See conversion tools.
Connections remain open for long periods	Measure whether SHARKSSL_ENABLE_SESSION_CACHE is worth its memory and code cost.
Service has a controlled algorithm set	Review configuration macros and test every required certificate and cipher combination.
Processor has a matching crypto backend	Follow Ports, including compiler flags, C dependencies, and fallback requirements.

Keep CA validation and expected-name checks. Do not disable elliptic curve point validation or timing protections to meet a footprint target. Retain a cryptographically suitable random number source and seed it as required by your platform. Alignment and word-size settings must match your processor and compiler.

Retest after each change

Use a full handshake as well as any resumed connection. Check rejection of an untrusted certificate and an unexpected server name. Exercise the largest expected certificate chain and application record, and measure peak RAM again. Verify date checks with a correct clock when enabled.

The IoT certificate tutorial explains how certificate choice affects memory. Its TLS 1.2 cipher example is a design example, not a universal minimal configuration for the current TLS 1.3 build.