Hi Chris

Thanks for the reply. Yes, I know about that API, but I am specifically interested in the Server random response. I know that this is not a required field per the RFC, but I would still like to parse it out from the SSL handshake.

I tried the enable tlsx and supported curves, but that doesn't get rid of the error message.

also a related question, which root CA cert should I use for the google.com test? does wolfSSL already come populated with some root CAs?

Some more info.

I compiled with with ./configure --enable-tlsx --enable-supportedcurves --disable-fastmath --enable-sslv3 --enable-curve25519 --enable-debug

and then $ ./examples/client/client -h google.com -p 443 -A ../ssltime/certs/Equifax_Secure_CA.pem seems to work. However, when I try

./examples/client/client -h umich.edu -p 443 -A ../ssltime/certs/AddTrust_External_Root.pem

I get:

connect state: CLIENT_HELLO_SENT
SSL version error
wolfSSL error occurred, error = -326
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -326
wolfSSL Entering ERR_error_string
err = -326, record layer version error
wolfSSL error: SSL_connect failed

with -v 1:

connect state: CLIENT_HELLO_SENT
received record layer msg
got ALERT!
Got alert
wolfSSL error occurred, error = 40
wolfSSL error occurred, error = -313
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -313
wolfSSL Entering ERR_error_string
err = -313, revcd alert fatal error
wolfSSL error: SSL_connect failed

with -v 2:

connect state: CLIENT_HELLO_SENT
SSL version error
wolfSSL error occurred, error = -326
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -326
wolfSSL Entering ERR_error_string
err = -326, record layer version error
wolfSSL error: SSL_connect failed

with -v 3:

connect state: CLIENT_HELLO_SENT
SSL version error
wolfSSL error occurred, error = -326
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -326
wolfSSL Entering ERR_error_string
err = -326, record layer version error
wolfSSL error: SSL_connect failed

I also wrote my own sample program to do an SSL handshake:

struct addrinfo* resolveHost(char *hostname, char *port) {
  struct addrinfo hints, *res, *p;
  int status;
  char ipstr[INET6_ADDRSTRLEN];

  memset(&hints, 0, sizeof hints);
  hints.ai_family = AF_UNSPEC; //IP v4 or v6 we dont care
  hints.ai_socktype = SOCK_STREAM;

  status = getaddrinfo(hostname, port, &hints, &res);
  if (status != 0)
    return NULL;

  /*for(p = res; p != NULL; p = p->ai_next)
  {
    void *addr;

    if (p->ai_family == AF_INET) //IPv4
    {
      struct sockaddr_in *ipv4 = (struct sockaddr_in *) p->ai_addr;
      addr = &(ipv4->sin_addr);
    }
    else
    {
      struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *) p->ai_addr;
      addr = &(ipv6->sin6_addr);
    }

    //convert IP to string
    inet_ntop(p->ai_family, addr, ipstr, sizeof ipstr);
    printf("%s\n", ipstr);
  }

  freeaddrinfo(res);*/

  return res; //to be freed upon program exit
}

void driver(char *hostname, char *port, char *capath) {
  int sockfd;
  WOLFSSL_CTX* ctx;
  WOLFSSL* ssl;

  wolfSSL_Init();

  struct addrinfo *host = resolveHost(hostname, port);

  if ((ctx = wolfSSL_CTX_new(wolfSSLv23_client_method())) == NULL)
    printf("%s\n", "wolfSSL_CTX_new error");
  else {
    //load up CA certs
    int err;
    if ((err = wolfSSL_CTX_load_verify_locations(ctx, capath, NULL)) != SSL_SUCCESS) {
      char buffer[WOLFSSL_MAX_ERROR_SZ];
      printf("%s: %s\n", "error loading up CA cert", wolfSSL_ERR_error_string(err, buffer));
    }
    else {
      //we are ready to SSL handshake
      if (host != NULL) {
        sockfd = socket(host->ai_family, host->ai_socktype, host->ai_protocol);
        int ret = connect(sockfd, host->ai_addr, host->ai_addrlen);
        if (ret < 0)
          printf("error in connect: %s\n", strerror(errno));
        else {
          printf("Connected to %s:%s!\n", hostname, port);

          if ((ssl = wolfSSL_new(ctx)) == NULL)
            printf("%s\n", "wolfSSL_new error");
          else {
            wolfSSL_set_fd(ssl, sockfd);
            if (wolfSSL_connect(ssl) == SSL_SUCCESS)
              printf("%s\n", "SSL handshake complete");
            else {
              int err = wolfSSL_get_error(ssl, 0);
              char buffer[WOLFSSL_MAX_ERROR_SZ];
              printf("%s: %s\n", "SSL handshake error", wolfSSL_ERR_error_string(err, buffer));
            }
          }
        }
      }
      else
           printf("error looking up IP for %s\n", hostname);
    }
  }

  wolfSSL_CTX_free(ctx);
  wolfSSL_Cleanup();

  close(sockfd);
  freeaddrinfo(host);
}

int main(int argc, char *argv[]) {
  char *hostname = (char *) argv[1];
  char *port = (char *) argv[2];
  char *cert = (char *) argv[3];
  printf("cert: %s\n", cert);
  driver(hostname, port, cert);
  return 0;
}

and when I run this like

./a.out google.com 443 Equifax_Secure_CA.pem

I get the usual recvd alert fatal error.

Not sure what's going on here. Did I compile incorrectly? Did I install incorrectly?