Hi,
Thank you for your response.

I'm using wolfSSL-3.12.0 with the settings like,
./configure --enable-ecc -enable-tls13 && make.

And I'm giving the below commands to run server and client,
Server_1: ./examples/server/server -v 4 -l TLS13-AES128-GCM-SHA256
Client_1: ./examples/client/client -v 4 -l TLS13-AES128-GCM-SHA256

Server_2: ./examples/server/server -v 4 -l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384
Client_2: ./examples/client/client -v 4 -l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384

In both the cases, wolfssl server closing the client connection. Find the following debug messages,

Could not verify suite validity, continue
Unsupported cipher suite, ClientHello
wolfSSL Leaving DoTls13HandShakeMsgType(), return -501
wolfSSL Leaving DoTls13HandShakeMsg(), return -501
wolfSSL error occurred, error = -501
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -501
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -501
wolfSSL Entering ERR_error_string
SSL_accept error -501, can't match cipher suite
wolfSSL error: SSL_accept failed

Request you to please check  the attached log for your complete reference of error.

Regards,
Ravi.

Hi Kaleb,
Thank you for your quick response.
I configured wolfSSL with the settings like, ./configure --enable-ecc -enable-tls13 && make.

And I'm using the below commands,
./examples/server/server -v 4 -l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384
./examples/client/client -v 4 -l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384

./examples/server/server -v 4 -l TLS13-AES128-GCM-SHA256
./examples/client/client -v 4 -l TLS13-AES128-GCM-SHA256

In both the cases, I'm getting SSL_accept error -501, can't match cipher suite
wolfSSL error: SSL_accept failed. Request you to please check  the attached log for your reference of error.

Regards,
Ravi.

David Garske,

Thank you for your quick response. Now it is compiling with your suggestion.

Regards,
Ravi.

Hi Chris,

I will let you know the option. Can you please suggest tools to use for conversion from .p7b to .pem or .cert? Can openssl do the conversion?

Thanks,
Ravi.

Hi Kaleb,

Thank you for your  support. Now its working. It was our mistake.

Thanks,
Ravi.

Hi Kaleb,

Thanks for the reply.

Now I have moved to new cyassl code(3.9.10).
But still issue is coming.
I have debugged the issue and concluded that multiplication operation is failing because of improper creation of ecc point from array values.

Please check the below code which I am using to create ecc_point from array values.

unsigned char gx[32] = {0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc, 0xe6, 0xe5, 0x63, 0xa4, 0x40, 0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d, 0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98, 0xc2, 0x96};
unsigned char gy[32] = {0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb, 0x4a, 0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf, 0x51, 0xf5};
unsigned char gz[32] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

    ecc_point *G1 = NULL;
    G1 = wc_ecc_new_point();

    if(G1 == NULL)
    {
      printf("Allocation failed\n");
      return;
    }

    memset(G1, 0, sizeof(ecc_point));

    mp_read_unsigned_bin(G1->x, gx, sizeof(gx));
    mp_read_unsigned_bin(G1->y, gy, sizeof(gy));
    mp_read_unsigned_bin(G1->z, gz, sizeof(gz));

I am sure issue is in this code only. Please correct the above code.

Thanks and regards,
Ravi Kumar

Hi Kaleb,

Thank you for your response. Finally I resolved the issue. Actually issue was with certificate. Whatever certificate we got from our customer is having private key in PKCS#8 format which has different ASN parsing code. If you see the input dump to RsaPrivateKeyDecode() function it is matching with the PKCS#8 ASN.1 parsing and it requires header and footer as "----BEGIN PRIVATE KEY---" and "---END PRIVATE KEY---" respectively. But customer is loading the private key as PKCS#1 format which has header and footer "---BEGIN RSA PRIVATE KEY---" and "---END RSA PRIVATE KEY----" respectively because of that Cyassl was throwing ASN parse error. If we  just change the header and footer of private key to the PKCS#8 format. it started working.

FYI:
1. PKCS#8 has following ASN.1 parsing (see the RFC 5208).
PrivateKeyInfo ::= SEQUENCE {
version Version,
privateKeyAlgorithm AlgorithmIdentifier PrivateKeyAlgorithms,
privateKey PrivateKey,
attributes [0] Attributes OPTIONAL }

Version ::= INTEGER
{v1(0)}

(v1,...)
PrivateKey ::= OCTET STRING

2. PKCS#1 has following ASN.1 parsing
RSAPrivateKey ::= SEQUENCE
{
  version Version,
  modulus INTEGER, -- n
  publicExponent INTEGER, -- e
  privateExponent INTEGER, -- d
  prime1 INTEGER, -- p
  prime2 INTEGER, -- q
  exponent1 INTEGER, -- d mod (p-1)
  exponent2 INTEGER, -- d mod (q-1)
  coefficient INTEGER, -- (inverse of q) mod p
  otherPrimeInfos OtherPrimeInfos OPTIONAL
}

Private key input was going as PKCS#8 format.
e.g.
0x30, 0x82, 0x4, 0xbe
0x2, 0x1, 0x0
0x30, 0xd, 0x6, 0x9, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0xd, 0x1, 0x1, 0x1, 0x5, 0x0 (failed at this point as PKCS#8 is expecting 0x2 INTEGER)
0x4, 0x82, 0x4, 0xa8, 0x30 ...

Thanks and Regards,
Ravi.