• Registered: 2016-09-20
  • Posts: 1

Topic: Reading incorrect certificate date

I'm working on implementing the mqtt and wolfssl library on an MQX based embedded system.
the libraries versions are: wolfmqtt-0.8  and wolfssl-3.9.8

I'm using the wolfssl to encrypt the mqtt messages.

During the the wolfssl connect, I encounter an error ASN_BEFORE_DATE_E. attached log at the bottom.

upon investigating I saw that the error is originating from the function ValidateDate().
ValidateDate() is reading the time from the certificate using function ExtractDate(),
but the date ExtractDate() is returning is one day later then the real date.

e.i. I created the certificate today (using Amazon aws IOT) and the date ExtractDate() is returning is of tomorrow.

I'll be grateful if you'll help solve this issue.
Hagai.


LOG:

wolfSSL Entering wolfSSL_Init
wolfSSL Entering WOLFSSL_CTX_new_ex
wolfSSL Entering wolfSSL_CertManagerNew
wolfSSL Leaving WOLFSSL_CTX_new, return 0
wolfSSL Entering wolfSSL_CTX_set_verify
wolfSSL Entering wolfSSL_CTX_load_verify_buffer
Processing CA PEM file
wolfSSL Entering PemToDer
Adding a CA
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetMyVersion
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name

debug -- read time: ValidateDate:3175.
    local time: 116/8/19 10:48
    cert time  116/8/20 06:50

Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeSubjKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeKeyUsage
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
    Parsed new CA
    Freeing Parsed CA
    Freeing der CA
        OK Freeing der CA
wolfSSL Leaving AddCA, return -150
wolfSSL error occurred, error = -150
CA Parse failed, with progress in file.

Share

  • Registered: 2015-10-07
  • Posts: 431

Re: Reading incorrect certificate date

Hi Hagai,

That's great you are using wolfMQTT and wolfSSL with Amazon AWS! It would be excellent to get more info on your project by emailing us at info@wolfssl.com when you get a chance.

I've seen an issue like this before and it was due to timezone differences between local time and the time in the cert. The ValidateDate function tries to offset the local time by looking for +/- at the end of the cert begin/end dates.

If you are using the FREESCALE_MQX or FREESCALE_KSDK_MQX defines the asn.c XTIME gets mapped to mqx_time which ends up calling "_time_get". The mqx_time function should be getting the number of seconds since UTC.

You might consider implementing your own XTIME function and by defining "USER_TIME" and adding a new function in your code called XTIME: time_t XTIME(time_t * timer);. Then you can offset the XTIME your timezone diff.

Thanks, David Garske, wolfSSL

Share