Hi mkey,

It looks like verification of the peer certificates is failing - possibly due to the incorrect CA cert being loaded.  Can you verify once again that you converted the certificate (Equifax_Secure_Certificate_Authority_DER.cer) to PEM format before loading it with CyaSSL_CTX_load_verify_locations(), and that this is the CA cert you are loading?

You can convert the certificate using the OpenSSL command line tool:

openssl x509 -inform der -in Equifax_Secure_Certificate_Authority_DER.cer -out Equifax_Secure_Certificate_Authority.pem

Chris

Hi Nitin,

A RSA private key contains the public key, therefore CyaSSL is able to use it as both the public and private key as used in test.c.  You can load a separate public key using RsaPublicKeyDecode if you would like.  Apart from this, RsaSSL_Sign and RsaSSL_Verify are just inverse operations to the RsaPublicEncrypt and RsaPrivateDecrypt functions described in the CTaoCrypt Usage Reference.

CTaoCrypt doesn't currently have functionality to generate an individual public key (but the private key does contain the public key, as mentioned above).  The reasoning behind this is that for SSL, the private key and the public key in the form of a certificate is all that is needed.  You could use the OpenSSL command line utility to generate an individual public key based off your private key if needed.

Regards,
Chris

Hi,

Can you try using the most recent CyaSSL sources from GitHub (https://github.com/cyassl/cyassl) and see if your issue is resolved?  We recently made some changes to how CyaSSL processes CA certificates.  Please let me know if you are still having troubles.

Best Regards,
Chris

Hi protocold,

You can build only the CyaSSL embedded SSL library (excluding examples, testsuite, etc.) by issuing the following after ./configure:

make src/libcyassl.la

Regards,
Chris

Hi Pedro,

I believe this is due to the way you have entered your certificate string.  Try only separating lines with a newline (\n), and add a newline character after the closing "-----END CERTIFICATE-----" as well.  So, your corrected cert string would be:

const char cert[]= "-----BEGIN CERTIFICATE-----\nMIIDAjCCAmsCEH3Z/gfPqB63EHln+6eJNMYwDQYJKoZIhvcNAQEFBQAwgcExCzAJ\nBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh\nc3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy\nMTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp\nemVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X\nDTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw\nFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMyBQdWJsaWMg\nUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo\nYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5\nMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB\nAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4\npO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0\n13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4mx0ciU9cZwID\nAQABMA0GCSqGSIb3DQEBBQUAA4GBAFFNzb5cy5gZnBWyATl4Lk0PZ3BwmcYQWpSk\nU01UbSuvDV1Ai2TT1+7eVmGSX6bEHRBhNtMsJzzoKQm5EWR0zLVznxxIqbxhAe7i\nF6YM40AIOw7n60RzKprxaZLvcRTDOaxxp5EJb+RxBrO6WVcmeQD2+A2iMzAo1KpY\noJ2daZH9\n-----END CERTIFICATE-----\n";

One thing to keep in mind is that you can turn on CyaSSL debugging by configuring CyaSSL with the "--enable-debug" option.  This will give you a much more verbose output of what is happening with CyaSSL.  After building CyaSSL with this enabled, you can turn on debug messages in your application by calling:

CyaSSL_Debugging_ON();

After you get your certificate to load (PCA-3G2.pem), you will probably run into another problem where CyaSSL doesn't think it is actually a CA certificate.  This is due to it lacking the CA:TRUE basic constraint.  If you would still like to use this certificate, you can download our current GitHub source package (https://github.com/cyassl/cyassl) which will allow this certificate to be imported as a CA cert.

Thanks for the heads up on this.  We'll make sure to get this cleared up.

Let me know if this helps.  By the way, what kind of project are you working on for the Wii?

Best Regards,
Chris

Hi Pedro,

DevkitPro support was added with CyaSSL rc2-1.0.0.  You can take a look at the CyaSSL README file (included in the CyaSSL download) for build instructions and more detailed information.  This will explain how to build and link with CyaSSL.  Please let me know if you run into problems.

Regards,
Chris

Hi Nitin,

What command and parameters did you use to generate your CA key using OpenSSL?

- Chris

Hi Nitin,

You could be seeing this error if CYASSL_CERT_GEN is not defined.  Can you try defining -DCYASSL_CERT_GEN this when building your application and see if it resolves your error?

Regards,
Chris

Hi Kevin,

What version of CyaSSL are you using the tutorial with?

This error occurs when the OS can't find the necessary shared library at runtime.  This could be caused by several things depending on what version of CyaSSL you were using.

1.  I just updated the SSL Tutorial (Makefiles, source files, etc.) to work with our newest versions of CyaSSL (2.0.2).  Beginning with our 2.0.0rc3 release, the default installation locations were changed for CyaSSL.  Please try downloading the most current version of the SSL Tutorial, now up at http://www.yassl.com/documentation/ssl-tutorial-2.0.zip.

2.  If you are still getting the error after updating to the newest SSL Tutorial version, make sure your LD_LIBRARY_PATH environment variable is set correctly to point to where the CyaSSL libraries are installed (/usr/local/lib in CyaSSL 2.0.2).

Linux:

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib

Mac:

export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH:/usr/local/lib

Does this help?

Regards,
Chris

Hi,

WolfSSL hasn't been officially ported to the Freescale MQX RTOS yet, no.  This is something that's on our list of things to do.  Is this something that you would be interested in?  Have you tried building wolfSSL on MQX?

Best Regards,
Chris

Hi Nrupen,

It looks like the common name of the subject lacks a set header in your certificate.  In our initial interpretation of the X509 standard, we believed that the set header was required.  As such, wolfSSL returned an error.

We have checked in a patch to our GitHub repository that gives a warning if a certificate name lacks a set header, then continues execution for better OpenSSL compatibility.  Please take a look at the patch, here: https://github.com/cyassl/cyassl/commit … 7d53a812ea.

What kind of project are you working on?

Regards,
Chris

Yes, in it's current state, yaSSL only supports public keys through certificates (for SSL).  Would you mind if I asked what your goal is?  If this feature is necessary, we can work with you to add it to yaSSL.

Regards,
Chris