Hi confused_squirrel,

Thanks for your interest in wolfSSL.  You are on the right track with our getter functions such as GetASN_Items and GetASN_OID, these are the functions we use to parse ASN and the functions you should call for this case.  These are internal static functions, we do not have a public interface for this.  You will need to find a way to call static wolfSSL functions from your application, or patch our source to make these functions non static.
We don't currently have a complete example on how to use these functions as again, they are internal functions.

Are you willing to share some information about your project?  Are you working on a commercial or personal project?  You are welcome to email us at support [AT] wolfssl [DOT] com if this information is confidential.

Thanks,
Kareem

The definitions go in your project's user_settings.h.
Yes, check out our blog post here: https://www.wolfssl.com/using-curl-with … d-tls-1-3/

Hi Samuel,

What version of wolfSSL are you using?  If you aren't using our latest release 5.7.0, please upgrade.

HAVE_CURL is not sufficient, you will need multiple other defines as follows:

#define HAVE_TLS_EXTENSIONS
#define HAVE_SNI
#define HAVE_SUPPORTED_CURVES
#define HAVE_FFDHE_2048
#define WOLFSSL_TLS13
#define HAVE_EXTENDED_MASTER
#define NO_RC4
#define HAVE_ENCRYPT_THEN_MAC
#define HAVE_CRL
#define HAVE_CERTIFICATE_STATUS_REQUEST
#define HAVE_CERTIFICATE_STATUS_REQUEST_V2
#define WOLFSSL_ALT_CERT_CHAINS
#define WOLFSSL_IP_ALT_NAME
#define HAVE_SESSION_TICKET
#define NO_SESSION_CACHE_REF
#define WOLFSSL_DES_ECB
#define WOLFSSL_TICKET_NONCE_MALLOC
#define NO_PSK
#define WOLFSSL_ENCRYPTED_KEYS
#define HAVE_DH_DEFAULT_PARAMS
#define WOLFSSL_SYS_CA_CERTS
#define HAVE_OCSP
#define OPENSSL_EXTRA
#define NO_DES3_TLS_SUITES
#define WOLFSSL_PUBLIC_MP
#define HAVE_SERVER_RENEGOTIATION_INFO

Thanks,
Kareem

Hi Simon,

To remove support for our AES CCM cipher suites, build wolfSSL with HAVE_AESCCM not defined.  If you are using configure, you can use the argument --disable-aesccm to disable this.

Thanks,
Kareem

Hi Samuel,

It looks like you are not enabling our OpenSSL compatibility layer when building curl, this implements EVP_MD_CTX and many other OpenSSL types/functions.  Please share your build settings for wolfSSL and wolfSSL version.  You should be building wolfSSL with --enable-curl to use it with curl.

Thanks,
Kareem

Hi Prabhu,

Our Microchip Harmony library is not licensed under GPL, it has a custom license which you can review here: https://github.com/Microchip-MPLAB-Harm … crochip.md

Please let me know if you have any further questions on this.

Thanks,
Kareem

Copying from zendesk ticket:

When including wolfSSL headers in your application, you must include our build settings (options.h/settings.h) first as follows:

#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/settings.h>

You need to include these headers before all other wolf/OpenSSL headers in all files which include these headers.  Please give it a try and let me know if it helps.

Please rebuild wolfSSL with --enable-debug defined and post debug logs of the server to help confirm what is going wrong.  Please also include your full wolfSSL build settings, ./configure line or user_settings.h.
Is your embedded client running wolfSSL, or something else?

Hi Resarf,

We haven't tried wolfTPM on a Raspberry Pi Pico, but we would expect it to work based on the platform's specs and wolfTPM's requirements.

Which TPM are you planning to use?  Will you be attaching a physical TPM to your Pi?

You will need to build wolfTPM with the appropriate configure option for your TPM, you can find a full description of our configure options here: https://github.com/wolfSSL/wolftpm#buil … nd-defines

Thanks,
Kareem

Hello Mike,

Yes, your understanding of PSK is correct.  I would recommend using PSK with ECDHE for this reason, if feasible.  TLS 1.3 does generally offer forward secrecy, but there are cases where you would want to use PSK only, so it is still offered despite not offering forward secrecy.

You can turn on debug logging in wolfSSL to confirm the key exchange and connection are being completed as expected by building wolfSSL with --enable-debug.  You could also capture a packet dump and open it with Wireshark to confirm everything being sent and received matches your expectations.

You may find our PSK examples and documentation here helpful: https://github.com/wolfSSL/wolfssl-exam … master/psk

Thanks,
Kareem

Hi OptiZle,

The examples include a user_settings.h which is tuned for the ESP32, I would recommend retrying with this.  Our generic user_settings_default.h file is meant as a reference, and is not suitable out of the box for the ESP32.

Yes, we've recently improved our ESP32 support and added support for the S3.  I don't believe this support was present in 5.5.4.  I would strongly recommend upgrading.

Thanks,
Kareem

Hi lazH,

Your code is currently passing in the entire certificate DER to wc_RsaPublicKeyDecode, this won't work as wc_RsaPublicKeyDecode expects just the key.
You will need to call wolfSSL_X509_load_certificate_file followed by wolfSSL_X509_get_pubkey on your certificate to extract the public key.  You can then call wc_RsaPublicKeyDecode on this extracted public key and use it as desired for encryption/decryption.
Check out our full example of this here: https://github.com/wolfSSL/wolfssl-exam … m-certfile

Thanks,
Kareem