Hi akhi_gangwar,

The error -188 means a certificate could not be validated to a trusted peer. The TLS Peer is sending 4 certificates and some of these are not validating. By default wolfSSL expects all provided certificates get validated. My guess is you are loading an intermediate CA and not the root CA. You can either load the correct root CA or you can add our `WOLFSSL_ALT_CERT_CHAINS` build option. This option only requires the peer's provided certificate matches to a loaded/trusted cert.

Also you can load PEM files directly using SSL_FILETYPE_PEM.

Thanks,
David Garske, wolfSSL

Hi Carlo,

The non-blocking mode is on by default for TLS. You can just configure your socket as non-blocking and you'll be good. The read/write IO callback return "want write" or "want read" to indicate would block. The old `wolfSSL_set_using_nonblock` function maps to `wolfSSL_dtls_set_using_nonblock`, which only applies to the DTLS case.

You can find some TLS and DTLS examples in our wolfssl-examples repo. There is a TLS non-blocking example here:
https://github.com/wolfSSL/wolfssl-exam … blocking.c

Thanks,
David Garske, wolfSSL

Hi waigor,

The RSA keys will use more memory. Have you tried increasing the static memory pool size? What cipher suites are you trying to use with RSA and what TLS version?

Thanks,
David Garske, wolfSSL

Hi Carlo,

Thanks for your questions and feedback. Doing a wolfSSL read/write for the same WOLFSSL object at the same time is not thread safe by efault. The WOLFSSL object should only be used from a single thread. However we do have a build-time feature you can enable to allow read and write on separate threads. This feature is enabled using the `HAVE_WRITE_DUP` build option.

You can find an example for this feature here:
https://github.com/wolfSSL/wolfssl-exam … writedup.c

This allows creation of a second WOLFSSL object for writing only. The existing WOLFSSL object is flagged as read-only.

/* Duplicate read_ssl, setting it to read-only, creating write_ssl, which is write-only */
if ((write_ssl = wolfSSL_write_dup(read_ssl)) == NULL) {
    fprintf(stderr, "ERROR: failed write dup\n");
    return -1;
}

Thanks,
David Garske, wolfSSL

Hi cxdinter,

Yes we fully support RSA PSS padding. It was added with the TLS v1.3 support back in May 17, 2017.

To enable it use `./configure --enable-rsapss` or define `WC_RSA_PSS`.

The API's are `wc_RsaPSS_VerifyInline`, `wc_RsaPSS_Verify`, `wc_RsaPSS_CheckPadding`, `wc_RsaPSS_VerifyCheck`, `wc_RsaPSS_Sign`, etc...

See inline API documentation here:
https://github.com/wolfSSL/wolfssl/blob … sa.c#L3206

Thanks,
David Garske, wolfSSL

Hi conallanoc,

The "authIn" is the AAD (additional authenticated data). Its extra data that can be included for the authentication tag generated. On an encrypt the "authTag" is generated and on decrypt you provide the value and the tag is compared after decryption to ensure integrity of the data.

Here is a NIST document for AES GCM test vectors: https://csrc.nist.gov/CSRC/media/Projec … /gcmvs.pdf

Thanks,
David Garske, wolfSSL

Hi Chris,

Are you using the latest Curl and what is the TLS engine you are using in Curl? The `curl -h | sed -ne '/--tlsv/p' ` command will show you the TLS versions.

Is your Curl using openssl? Try running `openssl ciphers -v | grep TLSv1.3` and make sure the cipher suite is listed.

I ran a quick test on my Mac and it worked against openssl s_client. Using CURL I got a similar error, but I am running an older Curl.

./configure --enable-tls13 && make
./examples/server/server -d -b -g -v 4 -l TLS13-CHACHA20-POLY1305-SHA256
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL curve name is SECP256R1
Client message:

openssl s_client -tls1_3 -ciphersuites 'TLS_CHACHA20_POLY1305_SHA256' -connect localhost -port 11111
...
wolfSSL has successfully performed handshake!
...

./examples/server/server -d -b -g -v 4 -l TLS13-CHACHA20-POLY1305-SHA256
SSL_accept error -308, error state on socket
wolfSSL error: SSL_accept failed

curl --version
curl 7.62.0-DEV (x86_64-apple-darwin17.7.0) libcurl/7.62.0-DEV wolfSSL/3.15.3 zlib/1.2.11 nghttp2/1.39.2
Release-Date: [unreleased]

curl -vvv -k --tlsv1.3 https://localhost:11111
*   Trying ::1...
* TCP_NODELAY set
* Connection failed
* connect to ::1 port 11111 failed: Connection refused
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 11111 (#0)
* CyaSSL: TLS 1.3 is not yet supported
curl: (35) CyaSSL: TLS 1.3 is not yet supported

Thanks,
David Garske, wolfSSL

Hi s123unny,

The DTLS server handles the peer address filter via the IO callbacks and the `wolfssl.set_dtls_fd`. See wolfSSL.cs `wolfSSL_dtlsCbIOSend` and `wolfSSL_dtlsCbIORecv`. Is there a use-case this is not covering for you?

I will still make a feature request note for `wolfssl.dtls_set_peer` -> `wolfSSL_dtls_set_peer`.

Thanks,
David Garske, wolfSSL

Hi Kannan,

We support the A9 and Aarch64 speedups and the Zynqmp hardware acceleration.
Here is the wolfSSL FreeRTOS Xilinx port:
https://github.com/wolfSSL/wolfssl-examples/pull/155

Here is Xilinx's performance write up on it:
https://www.xilinx.com/support/document … crypto.pdf

Thanks,
David Garske, wolfSSL

Hi windyMk92,

Yes that all looks correct. Depending on your platform you may need to do a "sudo ldconfig" after the "sudo make install". Additionally some platform use "usr" and some use "usr/local", so you might need to adjust things. If you want to force wolfSSL configure to install to a different location use `./configure --prefix=/usr` (for example).

For wolfcrypt-py install using the local wolfCrypt are you using this command `sudo USE_LOCAL_WOLFSSL=/usr/local pip3 install .`?

Are you still getting the same `libwolfssl.so.24: cannot open shared object file: No such file or directory` error?

Thanks,
David Garske, wolfSSL

Hi rvogel,

Your code looks correct for loading a trusted CA. I would suggest its not locking up, but instead is taking a long time. Internally its doing an asymmetric verify operation. Are you able to see with a debugger where its "locking up". Have you confirmed you have enough stack/heap available? Is this an ECC or RSA certificate? Have you tried enabling debug logging? To do so define DEBUG_WOLFSSL and call wolfSSL_Debugging_ON();. If you want to redirect to printf instead of the default sprintf(stderr define `WOLFSSL_LOG_PRINTF`.

Thanks,
David Garske, wolfSSL