Hi earlenceferns,

Although not in the example client usage, the "-W" parameter requires an argument.  Using your above command, to connect to mozilla.org:443 using OCSP Stapling V2, you would want to do:

$ cd wolfssl-3.9.6
$ ./configure --enable-ocspstapling2
$ make
$ ./examples/client/client -h mozilla.org -p 443 - A DigiCert_High_Assurance_EV_Root_CA.pem -W 2

Best Regards,
Chris

Hi athorel-asi,

Thanks for posting and letting us know you fixed your issue!

Best Regards,
Chris

Hi sfefanoss1019,

If you want to import an ECC key in DER format into an ecc_key structure, you will want to use the following function.  If you are importing an ECC generated by OpenSSL, you will want to compile wolfSSL with ECC_DECODE_EXTRA defined.

#include <wolfssl/wolfcrypt/asn_public.h>
int wc_EccPublicKeyDecode(const byte* input, word32* inOutIdx, ecc_key* key, word32 inSz);

If you instead want to import an ECC key into a WOLFSSL_CTX structure, for use in an SSL/TLS connection, you can use the following function.  Again, you will need to compile wolfSSL with ECC_DECODE_EXTRA if loading an ECC key generated by OpenSSL:

#include <wolfssl/ssl.h>
int wolfSSL_CTX_use_PrivateKey_file(WOLFSSL_CTX* ctx, const char* file, int format);

The "format" parameter in the above function should be either SSL_FILETYPE_PEM if the key is PEM formatted or SSL_FILETYPE_ASN1 for a DER formatted key.

Best Regards,
Chris

Hi Michael,

I verified that the wolfCrypt test's certificate request generation successfully generates "certreq.pem" using both the normal and fastmath libraries, on my development machine (OSX).

To address your header question, can you first verify that wolfSSL and your application are being compiled with the exact same preprocessor defines?  If these differ it's very possible that you could be seeing problems.  That was the issue the the post you linked to.

Thanks,
Chris

Hi Colin,

Great! Glad that fixed your problem.

Best Regards,
Chris

Hi,

In order to use DH with TLS, you will need to load your DH parameter file into the server.  If using wolfSSL, that is done with the wolfSSL_SetTmpDH() function.  You can see an example of this in the wolfSSL example server (./examples/server/server.c).

Unless you have disabled DH support when compiling wolfSSL, DH cipher suites will be available.  If you want to set a specific cipher list, you can do this with the wolfSSL_CTX_set_cipher_list() function.

To have the server authenticate the client, you will want to enable peer verification on the server side by calling wolfSSL_CTX_set_verify.  For example:

SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT),0);

Best Regards,
Chris

Hi,

By default wolfSSL does all certificate verification internally.  The user can inspect and do custom verification using the wolfSSL verify callback.  The callback can be registered by passing it as the third argument to the wolfSSL_CTX_set_verify() function.  Ex:

void wolfSSL_CTX_set_verify(WOLFSSL_CTX* ctx, int mode, VerifyCallback vc);
typedef int (*VerifyCallback)(int preverify, WOLFSSL_X509_STORE_CTX* store);

Normally, the verify callback is only called upon verification failure.  If you define WOLFSSL_ALWAYS_VERIFY_CB, the callback will always be called.  In this case, if "preverify" is equal to "1", wolfSSL has already successfully verified the peer certificate.  We provide this option for those users who wish to do custom inspection of certificate elements past normal certificate verification measures.

We have an example verify callback that overrides date errors.  It is called "myDateCb()", located in <wolfssl/test.h>.

Best Regards,
Chris

Hi,

Our understanding is that the memory exhausted error is a bug in some versions of binutils. The forum post you found[1] is the most current research we have done on this issue.

From user reports, adding "-g1" to C_EXTRA_FLAGS fixes the issue on Ubuntu, ie:

./configure <options> C_EXTRA_FLAGS="-g1"

What version of binutils are you using?  You can view this by executing "ld -v" from your terminal.  Are you able to update to a newer version of binutils?  This will also solve the issue.

Thanks,
Chris

[1] https://www.wolfssl.com/forums/topic493 … -flag.html

Hi,

Thanks for the additional details.  It looks like my attachment didn't work correctly last time.  Trying again here.

Thanks,
Chris

Hi,

--------- Server Random ----------

The server random value is sent during the ServerHello message of the SSL/TLS handshake.  This is later used to calculate the master secret.

wolfSSL exposes the following two functions when compiled with OPENSSL_EXTRA defined:

<wolfssl/ssl.h>

void wolfSSL_KeepArrays(WOLFSSL* ssl);
void wolfSSL_FreeArrays(WOLFSSL* ssl);
int wolfSSL_get_keys(WOLFSSL*,unsigned char** ms, unsigned int* msLen,
          unsigned char** sr, unsigned int* srLen,
          unsigned char** cr, unsigned int* crLen);

wolfSSL_get_keys() will give your application access to the master secret (ms), server random (sr), and client random (cr).  The pointers you pass in will point to those values held by wolfSSL internally.  The sizes of each are returned through msLen, srLen, and crLen.  This function must be called after the handshake completes.

Before the handshake starts, you need to call wolfSSL_KeepArrays() so these arrays remain available after the handshake finishes.  Your application can free the arrays by calling wolfSSL_FreeArrays(), or wait for the WOLFSSL object to be freed.

---------- umich.edu ----------

For connecting to "umich.edu", this server only supports static RSA cipher suites.  By default, wolfSSL has static RSA cipher suites disabled by default.  You can enable them at compile time by defining WOLFSSL_STATIC_RSA.  Adding that to your ./configure would be:

./configure --enable-tlsx --enable-supportedcurves --disable-fastmath C_EXTRA_FLAGS="-DWOLFSSL_STATIC_RSA"

After this, the example client will connect successfully to "umich.edu" using the attached root CA certificate:

./examples/client/client -h umich.edu -p 443 -v 1 -A addtrustexternalcaroot.crt

To determine the cipher suites and protocol version supported by "umich.edu", I used the "ssl-enum-ciphers" script provided by the nmap tool:

nmap --script ssl-enum-ciphers -p 443 umich.edu

Best Regards,
Chris

Hi,

As of the wolfSSL 3.9.6 release, we now have a GetTime() API in <wolfssl/wolfcrypt/asn_public.h> that returns the seconds since the Unix epoch:

/* Time */
/* Returns seconds (Epoch/UTC)
 * timePtr: is "time_t", which is typically "long"
 * Example:
    long lTime;
    rc = wc_GetTime(&lTime, (word32)sizeof(lTime));
 */
WOLFSSL_API int wc_GetTime(void* timePtr, word32 timeSize);

With recent changes to the google.com servers, wolfSSL now needs the TLS Supported Curves Extension enabled to successfully connect to gmail/google.com.  Can you try re-compiling wolfSSL using the "--enable-tlsx" (to enable all TLS Extensions) or "--enable-supportedcurves" option?

Thanks,
Chris

Hi,

Can you double check to make sure your application is getting compiled with the same preprocessor defines that wolfSSL was compiled with?  Sometimes a mismatch in settings can cause seg fault issues with the math libraries.

Also, for reference, we have a sign/verify example available in the following location.  This includes an example of doing a sign/verify with both ECC and RSA:

https://github.com/wolfSSL/wolfssl-exam … /signature

Thanks,
Chris