Hi Chris,
sorry for haven't replied you since your last post, but I had other things to do and I suspended the work on the server verification with the CA certificate.
I finally succeed in loading the CA certificate, but now I have another problem: when it tries to verify the server certificate chain I get errors -155 and -210. I tried with the CA certificate in both DER and PEM format, but it behaves in same manner in both case.
This is the code I wrote:
const unsigned char certCA_MW_root_der[1028] = {0x30, 0x82, 0x04, 0x00, 0x30, ....
void sslClient(char *server_ipaddr, int server_port)
{
int socket_fd;
char buff_err[80];
CYASSL_CTX* ctx;
CYASSL* ssl;
int i;
/* Initialize CyaSSL */
CyaSSL_Init();
i=CyaSSL_Debugging_ON();
/* Create and initialize CYASSL_CTX structure */
if ( (ctx = CyaSSL_CTX_new(CyaTLSv1_client_method())) == NULL){
print("SSL_CTX_new error.\r\n");
}
i=CyaSSL_CTX_load_verify_buffer(ctx, certCA_MW_root_der, sizeof(certCA_MW_root_der), SSL_FILETYPE_ASN1);
if(i != SSL_SUCCESS)
{
print("Error loading buffer certificate error %d\r\n", i);
}
CyaSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, 0);
.
.
.
Create the socket socket_fd
.
.
.
print("Loading ctx into ssl\r\n");
if( (ssl = CyaSSL_new(ctx)) == NULL) {
print("Unable to create SSL Object\r\n");
}
else
print("SSL object created\r\n");
print("Ready to set SSL Object\r\n");
if (CyaSSL_set_fd(ssl, socket_fd) != SSL_SUCCESS)
print("SSL_set Object failed\r\n");
else
{
print("SSL Object SET\r\n");
}
/* SSL HandShake Request */
print("Trying to establish SSL connection\r\n");
if ((i=CyaSSL_connect(ssl)) != SSL_SUCCESS)
{
i=CyaSSL_get_error(ssl, i);
CyaSSL_ERR_error_string(i, buff_err);
print("SSL_connect failed\r\n%s\r\n", buff_err);
}
else
print("CyaSSL connection established\r\n");
-------------------------------------------------------------------------------------------------------------------------------------
The following are the debugging information from CyaSSL:
CyaSSL Entering CYASSL_CTX_new
CyaSSL Entering CyaSSL_CertManagerNew
CyaSSL Leaving CYASSL_CTX_new, return 0
CyaSSL Entering CyaSSL_CTX_load_verify_buffer
Adding a CA
CyaSSL Entering GetExplicitVersion
CyaSSL Entering GetMyVersion
CyaSSL Entering GetAlgoId
Getting Cert Name
Getting Cert Name
CyaSSL Entering GetAlgoId
CyaSSL Entering DecodeCertExtensions
Extension type not handled, skipping
Extension type not handled, skipping
CyaSSL Entering DecodeBasicCaConstraint
CyaSSL Entering GetAlgoId
Parsed new CA
Freeing Parsed CA
Freeing der CA
OK Freeing der CA
CyaSSL Leaving AddCA, return 0
local ip address is: 132.147.2.205
connect to servicestestext.mywellness.com, port: 443
Loading ctx into ssl
CyaSSL Entering SSL_new
CyaSSL Leaving SSL_new, return 0
SSL object created
Ready to set SSL Object
CyaSSL Entering SSL_set_fd
CyaSSL Leaving SSL_set_fd, return 1
SSL Object SET
Trying to establish SSL connection
CyaSSL Entering SSL_connect()
1. CONNECT BEGIN SEND CLIENT HELLO
SEND_FUNCTION
--------------------
Bytes Send : 52
--------------------
connect state: CLIENT_HELLO_SENT
1. CONNECT BEGIN SEND CLIENT HELLO COMPLETED
2. CLIENT HELLO SENT
RECV_FUNCTION
--------------------
Bytes received 5
growing input buffer
RECV_FUNCTION
--------------------
Bytes received 2699
received record layer msg
CyaSSL Entering DoHandShakeMsg()
CyaSSL Entering DoHandShakeMsgType
processing server hello
CyaSSL Leaving DoHandShakeMsgType(), return 0
Do Hand Shake Msg ret 0
CyaSSL Leaving DoHandShakeMsg(), return 0
More messages in record
received record layer msg
CyaSSL Entering DoHandShakeMsg()
CyaSSL Entering DoHandShakeMsgType
processing certificate
Loading peer's cert chain
Put another cert into chain
Put another cert into chain
CyaSSL Entering GetExplicitVersion
CyaSSL Entering GetMyVersion
CyaSSL Entering GetAlgoId
Getting Cert Name
Getting Cert Name
CyaSSL Entering GetAlgoId
CyaSSL Entering DecodeCertExtensions
Extension type not handled, skipping
Extension type not handled, skipping
found optional critical flag, moving past
CyaSSL Entering DecodeBasicCaConstraint
CyaSSL Entering DecodeCrlDist
Extension type not handled, skipping
found optional critical flag, moving past
Extension type not handled, skipping
CyaSSL Entering GetAlgoId
About to verify certificate signature
Failed to verify CA from chain
Veriying Peer's cert
CyaSSL Entering GetExplicitVersion
CyaSSL Entering GetMyVersion
CyaSSL Entering GetAlgoId
Getting Cert Name
Getting Cert Name
CyaSSL Entering GetAlgoId
CyaSSL Entering DecodeCertExtensions
found optional critical flag, moving past
CyaSSL Entering DecodeBasicCaConstraint
Extension type not handled, skipping
found optional critical flag, moving past
Extension type not handled, skipping
CyaSSL Entering DecodeCrlDist
Extension type not handled, skipping
There are more Authority Information Access records, but we only use first one.
Extension type not handled, skipping
CyaSSL Entering DecodeAltNames
Not DNS type
Extension type not handled, skipping
Extension type not handled, skipping
CyaSSL Entering GetAlgoId
About to verify certificate signature
No CA signer to verify with
Failed to verify Peer's cert
No callback override availalbe, fatal
CyaSSL Leaving DoHandShakeMsgType(), return -155
Do Hand Shake Msg ret -155
CyaSSL Leaving DoHandShakeMsg(), return -155
CyaSSL error occured, error = -155
FATAL ERROR
CyaSSL Entering SSL_get_error
CyaSSL Leaving SSL_get_error, return -155
CyaSSL Entering ERR_error_string
SSL_connect failed
ASN sig error, confirm failure
SSL connect ok, sending GET...
CyaSSL Entering SSL_write()
handshake not complete, trying to finish
CyaSSL Entering CyaSSL_negotiate
CyaSSL Entering SSL_connect()
2. CLIENT HELLO SENT
received record layer msg
CyaSSL Entering DoHandShakeMsg()
CyaSSL error occured, error = -210
FATAL ERROR
CyaSSL Leaving CyaSSL_negotiate, return -1
CyaSSL Leaving SSL_write(), return -1
SSL_write failed
CyaSSL Entering SSL_read()
CyaSSL Entering ReceiveData()
Handshake not complete, trying to finish
CyaSSL Entering CyaSSL_negotiate
CyaSSL Entering SSL_connect()
2. CLIENT HELLO SENT
received record layer msg
CyaSSL Entering DoHandShakeMsg()
CyaSSL error occured, error = -210
FATAL ERROR
CyaSSL Leaving CyaSSL_negotiate, return -1
CyaSSL Leaving SSL_read(), return -1
CyaSSL Entering SSL_free
CTX ref count not 0 yet, no free
Shrinking input buffer
CyaSSL Leaving SSL_free, return 0
CyaSSL Entering SSL_CTX_free
CTX ref count down to 0, doing full free
CyaSSL Entering CyaSSL_CertManagerFree
CyaSSL Leaving SSL_CTX_free, return 0
CyaSSL Entering CyaSSL_Cleanup
--------------------------------------------------------------------------------------------------------
It says that it hasn't the right CA certificate to verify the server, but I'm absolutely sure that I put the right certificate in the code. I downloaded it from the site I want to connect to with Google Chrome. I took only the root CA certificate, as I read in the CyaSSL documents that only the root CA certificate is needed.
Since the previous problem were caused by a stack overflow error I also increased the stack size, but it had no effect.
I'll wait for your answer.
Best Regards
Dario
