TLS1.2 and api.amazon.com

[Matti Sillanpaa]

Posted on April 11, 2017 at 15:57

Hi.

I'm trying to communicate with api.amazon over SPWFSA01. Amazon requires secure communication, so I'm trying to put amazon approved certificate (got it from here:

https://www.amazontrust.com/repository/

). However I now got 'ERROR: Unable to load CA certificate' as I try to open the socket. Am I totally wrong here and should I generate the certificate by myself? I mean I understood from what I've read here and amazon that I should use amazon approved keys in the client side?

Whole trace of the situation:

+WIND:1:Poweron (170111-665d284-SPWF01S)

+WIND:13:ST SPWF01SA1 IWM: Copyright (c) 2012-2016 STMicroelectronics, Inc. All rights Reserved.

+WIND:46:WPA: Crunching PSK...

+WIND:32:WiFi Hardware Started

CMD: AT+S.TLSCERT2=clean,all

OK

CMD: AT+S.SETTIME=1491917021

OK

CMD: AT+S.TLSCERT=f_ca,13

api.amazon.com

CMD: AT+S.TLSCERT=f_cert,1207

-----BEGIN CERTIFICATE-----

MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF

ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6

b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL

MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv

b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj

ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM

9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw

IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6

VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L

93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm

jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC

AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA

A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI

U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs

N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv

o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU

5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy

rqXRfboQnoZsG4q5WTP468SQvvG5

-----END CERTIFICATE-----

OK

CMD: AT+S.TLSCERT=f_key,63

fbe3018031f9586bcbf41727e417b7d1c45c2f47f93be372a17b96b50757d5a2

OK

+WIND:19:WiFi Join:xx:xx:xx:xx:xx:xx

OK

+WIND:25:WiFi Association with 'TPNY' successful

+WIND:51:WPA Handshake Complete

OK

+WIND:24:WiFi Up:192.168.0.102

CMD: AT+S.SOCKON=api.amazon.com,443,s,ind

ERROR: Unable to load CA certificate

[Gerardo GALLUCCI]

Posted on April 11, 2017 at 18:47

Ciao Matti,

I think 'AT+S.TLSCERT=f_ca,13<cr>

api.amazon.com' is wrong. I mean, I expect '

api.amazon.com

' is the server domain name, not the CA. Use 'AT+S.TLSCERT=f_domain,13<cr>

api.amazon.com

' instead.

About CA, please download proper certificate, and load it inside the module using f_ca option.

Worst case, you'll get an 'unable to connect', and not an 'unable to load certificate'!

Let me know...

jerry

[Matti Sillanpaa]

Posted on April 12, 2017 at 13:31

Thanks for the pointer.

However regarding the certificate. Shouldn't the certificate only concern the case where this acts as server? I mean shouldn't this sort of client->server communication require security key (rsa-2048) or something like that? Or is that covered?

I'm trying to emulate curl here to get access token from amazon. I mean I don't have any specific certificates set to my linux and curl works just fine.

[Matti Sillanpaa]

Posted on April 12, 2017 at 09:39

Few extra questions here:

1. the certificate line changes. I'm using \n after each line. Should there be any (so one long string) or should there be both \r\n or something?

2. They certificate type. the one I'm using is so called CA root certificate. I'm using it directly so is it the problem here? Or should I generate something from it to connect amazon. I mean if just command line curl works OK with the api.amazon.com I would assume that very special certificate stuff isn't needed.

[Gerardo GALLUCCI]

Posted on April 12, 2017 at 16:50

Hi,

there are 3 authentication methods:

- anonymous: no certificates are needed

- one_way: f_ca must be loaded

- muthual: all certificates are needed

please ref. to AN4683

: Transport layer security protocol for SPWF01Sx module 

http://www.st.com/resource/en/application_note/dm00176553.pdf

 for details on certificate usage. Check your server to know which autentication is required.

[Matti Sillanpaa]

Posted on April 13, 2017 at 09:45

With new 3.0.0 drivers from SW and fully disconnecting & rebooting the SPWF01 I now have the communication working. No sertificates or such were required. Thanks for the support.