{"action":"created","issue":{"url":"https://api.github.com/repos/espressif/ESP8266_RTOS_SDK/issues/77","repository_url":"https://api.github.com/repos/espressif/ESP8266_RTOS_SDK","labels_url":"https://api.github.com/repos/espressif/ESP8266_RTOS_SDK/issues/77/labels{/name}","comments_url":"https://api.github.com/repos/espressif/ESP8266_RTOS_SDK/issues/77/comments","events_url":"https://api.github.com/repos/espressif/ESP8266_RTOS_SDK/issues/77/events","html_url":"https://github.com/espressif/ESP8266_RTOS_SDK/issues/77","id":196742957,"number":77,"title":"mbedtls gives error MBEDTLS_ERR_X509_CERT_VERIFY_FAILED","user":{"login":"muboldi","id":6748213,"avatar_url":"https://avatars.githubusercontent.com/u/6748213?v=3","gravatar_id":"","url":"https://api.github.com/users/muboldi","html_url":"https://github.com/muboldi","followers_url":"https://api.github.com/users/muboldi/followers","following_url":"https://api.github.com/users/muboldi/following{/other_user}","gists_url":"https://api.github.com/users/muboldi/gists{/gist_id}","starred_url":"https://api.github.com/users/muboldi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muboldi/subscriptions","organizations_url":"https://api.github.com/users/muboldi/orgs","repos_url":"https://api.github.com/users/muboldi/repos","events_url":"https://api.github.com/users/muboldi/events{/privacy}","received_events_url":"https://api.github.com/users/muboldi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-12-20T18:18:55Z","updated_at":"2017-02-08T02:19:36Z","closed_at":null,"body":"Hi,\r\n\r\nI'm using RTOS_SDK 1.5, trying to connect to AWS Iot.\r\n\r\nAt first i have a certificate with eliptic curve. But i get the error -15488 MBEDTLS_ERR_PK_UNKNOWN_PK_ALG. The mbedTLS documentation (https://tls.mbed.org/api/pk_8h.html#a877b66447bfa2cd49c1b99f1dc887568) describes the error as \"Key algorithm is unsupported (only RSA and EC are supported)\". If EC is supported in mbedTLS, why i'm getting this error? The support to EC was removed for the RTOS_SDK?\r\n\r\nThen i create a new certificate with RSA, and i'm getting the following error in the handshake -9984 MBEDTLS_ERR_X509_CERT_VERIFY_FAILED. I use the certificate in esp-open-rtos by SuperHouse (https://github.com/SuperHouse) and it works so is not the certificate.\r\n\r\n\r\nHere is the code to establish the connection, i take it from the aws_iot example of SuperHouse, it is similar to the Mbedtls_demo example of Espressif:\r\n\r\n```\r\n#include <esp_common.h>\r\n#include <freertos/portmacro.h>\r\n#include <lwip/sockets.h>\r\n#include <ipv4/lwip/inet.h>\r\n#include <lwip/netdb.h>\r\n#include <lwip/sys.h>\r\n#include <string.h>\r\n\r\n// this must be ahead of any mbedtls header files so the local mbedtls/config.h can be properly referenced\r\n#include \"ssl_connection.h\"\r\n\r\n#define SSL_READ_TIMEOUT_MS           2000\r\n\r\nconst char *pers = \"esp-tls\";\r\n\r\nstatic int handle_error(int err) {\r\n\r\n#ifdef MBEDTLS_ERROR_C\r\n    char error_buf[100];\r\n\r\n    mbedtls_strerror(err, error_buf, 100);\r\n    printf(\"%s\\n\", error_buf);\r\n#endif\r\n    printf(\"Error: %d\\n\", err);\r\n    return err;\r\n}\r\n\r\nvoid ssl_init(SSLConnection* conn) {\r\n    /*\r\n     * Initialize the RNG and the session data\r\n     */\r\n    mbedtls_net_init(&conn->net_ctx);\r\n    mbedtls_ssl_init(&conn->ssl_ctx);\r\n    mbedtls_ssl_config_init(&conn->ssl_conf);\r\n\r\n    mbedtls_x509_crt_init(&conn->ca_cert);\r\n    mbedtls_x509_crt_init(&conn->client_cert);\r\n    mbedtls_pk_init(&conn->client_key);\r\n\r\n    mbedtls_ctr_drbg_init(&conn->drbg_ctx);\r\n    mbedtls_entropy_init(&conn->entropy_ctx);\r\n\r\n}\r\n\r\nint ssl_connect(SSLConnection* conn, const char* host, int port) {\r\n    int ret;\r\n    char buffer[8];\r\n\r\n    ret = mbedtls_ctr_drbg_seed(&conn->drbg_ctx, mbedtls_entropy_func,\r\n            &conn->entropy_ctx, (const unsigned char *) pers, strlen(pers));\r\n    if (ret < 0) {\r\n        return -1;\r\n    }\r\n\r\n    ret = mbedtls_x509_crt_parse(&conn->ca_cert,\r\n            (const unsigned char *) conn->ca_cert_str,\r\n            strlen(conn->ca_cert_str) + 1);\r\n    if (ret < 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    ret = mbedtls_x509_crt_parse(&conn->client_cert,\r\n            (const unsigned char *) conn->client_cert_str,\r\n            strlen(conn->client_cert_str) + 1);\r\n    if (ret < 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n\r\n    ret = mbedtls_pk_parse_key(&conn->client_key,\r\n            (const unsigned char *) conn->client_key_str,\r\n            strlen(conn->client_key_str) + 1, NULL, 0);\r\n    if (ret != 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    snprintf(buffer, sizeof(buffer), \"%d\", port);\r\n    ret = mbedtls_net_connect(&conn->net_ctx, host, buffer, MBEDTLS_NET_PROTO_TCP);\r\n    if (ret != 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    ret = mbedtls_ssl_config_defaults(&conn->ssl_conf, MBEDTLS_SSL_IS_CLIENT,\r\n            MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);\r\n    if (ret != 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    mbedtls_ssl_conf_authmode(&conn->ssl_conf, MBEDTLS_SSL_VERIFY_REQUIRED);\r\n    mbedtls_ssl_conf_rng(&conn->ssl_conf, mbedtls_ctr_drbg_random, &conn->drbg_ctx);\r\n    mbedtls_ssl_conf_read_timeout(&conn->ssl_conf, SSL_READ_TIMEOUT_MS);\r\n    mbedtls_ssl_conf_ca_chain(&conn->ssl_conf, &conn->ca_cert, NULL);\r\n\r\n    ret = mbedtls_ssl_conf_own_cert(&conn->ssl_conf, &conn->client_cert, &conn->client_key);\r\n    if (ret != 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    ret = mbedtls_ssl_setup(&conn->ssl_ctx, &conn->ssl_conf);\r\n    if (ret != 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    ret = mbedtls_ssl_set_hostname(&conn->ssl_ctx, host);\r\n    if (ret != 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    mbedtls_ssl_set_bio(&conn->ssl_ctx, &conn->net_ctx, mbedtls_net_send, NULL, mbedtls_net_recv_timeout);\r\n    while ((ret = mbedtls_ssl_handshake(&conn->ssl_ctx)) != 0) {\r\n        if (ret != MBEDTLS_ERR_SSL_WANT_READ\r\n                && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {\r\n            if (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) {\r\n                return handle_error(ret);\r\n            }\r\n        }\r\n        handle_error(ret);\r\n\r\n        vTaskDelay(5000 / portTICK_RATE_MS);\r\n    }\r\n\r\n    mbedtls_ssl_get_record_expansion(&conn->ssl_ctx);\r\n    ret = mbedtls_ssl_get_verify_result(&conn->ssl_ctx);\r\n    if (ret != 0) {\r\n        return handle_error(ret);\r\n    }\r\n\r\n    return ret;\r\n}\r\n```\r\n\r\nIn this post https://forums.aws.amazon.com/thread.jspa?threadID=219255 suggest to check the root CA certificate to validate the AWS IoT server certificate. I alredy check it.\r\n\r\nAny idea or suggestion of what could be happen?\r\n\r\nThanks."},"comment":{"url":"https://api.github.com/repos/espressif/ESP8266_RTOS_SDK/issues/comments/278209471","html_url":"https://github.com/espressif/ESP8266_RTOS_SDK/issues/77#issuecomment-278209471","issue_url":"https://api.github.com/repos/espressif/ESP8266_RTOS_SDK/issues/77","id":278209471,"user":{"login":"muboldi","id":6748213,"avatar_url":"https://avatars.githubusercontent.com/u/6748213?v=3","gravatar_id":"","url":"https://api.github.com/users/muboldi","html_url":"https://github.com/muboldi","followers_url":"https://api.github.com/users/muboldi/followers","following_url":"https://api.github.com/users/muboldi/following{/other_user}","gists_url":"https://api.github.com/users/muboldi/gists{/gist_id}","starred_url":"https://api.github.com/users/muboldi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muboldi/subscriptions","organizations_url":"https://api.github.com/users/muboldi/orgs","repos_url":"https://api.github.com/users/muboldi/repos","events_url":"https://api.github.com/users/muboldi/events{/privacy}","received_events_url":"https://api.github.com/users/muboldi/received_events","type":"User","site_admin":false},"created_at":"2017-02-08T02:19:36Z","updated_at":"2017-02-08T02:19:36Z","body":"@gustavomassa I had got the same problem and i solved it defining the variable, as it is define in the official example of espressif. You can download it from here: https://github.com/espressif/esp8266-rtos-sample-code/tree/master/04Protocal/Mbedtls_demo.\r\n\r\n`unsigned int max_content_len = 3072;`\r\n\r\nThe max_content_len variable is define in Mbedtls_demo/app/programs/programs.c. Declare it somewhere in your code and should it compile.\r\n\r\nI copied the configuration of mbedtls library from open-rtos-sdk to RTOS_SDK and it gave me the same error (MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) when it try to establish the connection whit AWS IoT. I also ported the mbedtls library of open-rtos-sdk inside my project and i was able to compile it, but again i get the same error.\r\n\r\nBut give it a try and tell me if you could make it works, maybe i did some mistake.\r\n\r\nGood luck."}}
{"actor":{"display_login":"muboldi"}}