Hi Mohammed,

Thank you for the followup.  As you are working on a commercial project, please forward your issue to support [AT] wolfssl [DOT] com.

Thanks,
Kareem

Hello da,

We can look into adding a manual reset for the alert count, we will need to open a feature request for this.  Please email us at support [AT] wolfssl [DOT] com to set this up.

Thanks,
Kareem

Hello da,

Great question.  You can define the macro WOLFSSL_ALERT_COUNT_MAX to the max number of alerts you want to accept before throwing an error, so if you truly want to ignore alerts you can: #define WOLFSSL_ALERT_COUNT_MAX 9999
We do not reset the alert count in the code anywhere so this will eventually get tripped if enough alerts are accumulated.  The count is not reset until the WOLFSSL struct is freed.
I would recommend finding a way to fix the errors leading to alerts rather than ignoring/suppressing them.

Can you share some information about your project?  Are you working on a personal or commercial project?  Feel free to email us at support [AT] wolfssl [DOT] com if this information is sensitive.

Thanks,
Kareem

wolfSSL will attempt to include stdarg.h if OPENSSL_EXTRA is defined, you'll need to remove this define if you don't have this header available on your system.

Hi Nilesh,

I am happy to help.  So if I'm understanding right, you want to be able to update your certificate buffer without recompiling your application.  In this case we would recommend setting aside a section of flash for your certificate, and pointing your cert buffer to this address.  Then you can update your certificate by replacing this section rather than recompiling your entire application.

We don't support automatically generating certificates as described.  If you would like us to add support for this, we would need to set up a feature request, please contact us at support [AT] wolfssl [DOT] com to set this up.

Thanks,
Kareem

Hi Nilesh,

Great question.  Security wise, you are better off generating a new CA certificate with a lower expiration date like 1 year vs a longer expiration date like 20 years.
Around the 1 year mark when your certificate is about to expire, you will want to generate a new certificate for the server, we have some examples of how to do this with wolfSSL here: https://github.com/wolfSSL/wolfssl-exam … er/certgen
On the client side, you will need to load the newly generated CA certificate instead of the old one, since you are using a static buffer in code you'd need to update this buffer and rebuild your code.  If your device supports a filesystem, you could point wolfSSL to a file which you'd replace when the cert expires.

May I ask if you are using wolfSSL in a personal or commercial project?  Feel free to email us at support [AT] wolfssl [DOT] com if this information is sensitive.

Thanks,
Kareem

Hi OilProducts,

What version of wolfSSL are you using and which compiler are you using on OS X?  What version is your OS X compiler/toolchain?  If you aren't using our latest release 5.7.6, please give it a try and let me know if it helps.

Thanks,
Kareem

Hi de2,

Please share your build settings for wolfSSL and tinycurl, please also ensure you are using the latest version of each which is currently wolfSSL 5.7.4 and tinycurl 8.4.0.  Which TLS versions/algorithms do you require for your use case?

As you are using a static library, note that the library size is not the final size as the linker will discard a significant part of the library when linking to your application.  If you are using libcurl rather than tinycurl as a standalone application you will need to link it into your application then check the size with your toolchain's size utility or with the map file generated by your compiler.  Please also ensure that you are using your compiler's size optimization option (for example -Os) and have LTO enabled.

Thanks,
Kareem

Hi alem,

It looks like you're failing to build the kernel helper get_thread_size.  You could try bypassing the need to build this by building with KERNEL_THREAD_STACK_SIZE=16384 make, but we generally don't expect that you should be having issues building this.
Are you confident your kernel module build environment is set up correctly?  Are you able to build any other kernel modules, even an example "hello world" module?

Please share some details on your project and whether you are using wolfSSL in a commercial or personal project.  You are welcome to email us at support [AT] wolfssl [DOT] com if this information is sensitive.

Thanks,
Kareem

Hello Sunnysunday,

Those cipher suites require WOLFSSL_STATIC_PSK defined and PSK, AES/AES-CBC, TLS and SHA256 enabled.  It looks like your config is only missing WOLFSSL_STATIC_PSK, you will need to manually add this flag as it is not supported with a configure argument currently: "CFLAGS=-DWOLFSSL_STATIC_PSK" ./configure ...

Thanks,
Kareem

For the dynamic library error you need to copy the given hash into verifyCore in fips_test.c and rebuild wolfSSL.