2018-01-16 09:30 AM
Hi,
SPWF04Sx with FW1.1.0, mode miniAP
i loaded certificat in the wifi module
CA, cert and key based on
ECC (
prime256v1 aka NIST P-256)
and i run cmd
AT+S.HTTPGET
.I have error:
+WIND:29:DHCP Reply:192.168.0.2:02:A9:D2:A0:FF:A0
AT+S.HTTPGET=192.168.0.2,tls/cert.pem,443,2,,,ServerCert.pem,
AT-S.Http Client Error:1
AT-S.ERROR:111:Request failed
192.168.0.2 is IP of computer connected to wifi of the module wifi and module wifi try to connect (HTTPS client) to the computer to download ServerCert.pem file.
Do you see a problem?
Thks
Yoann
Solved! Go to Solution.
2018-02-20 08:11 AM
Hi Yoann,
my apologizes for the delay.
I was not well informed. Actually the 2.5K limits refer to each certificate in the bundle received from a peer. This apply to certificates received from a server (1way/mutual authentication) and to certificates received from a client (mutual authentication).
Instead, the size of the certificate bundle stored in 'cert' section or in 'tls.cert' file must be limited to 1475 bytes.
Regards,
Elio
2018-01-16 09:50 AM
AT-S.Http Client Error:1 is actually printed when the connection to the specified host (192.168.0.2) is refused, that is not a process listening on the specified port (443) or a firewall is denying the access.
Is this your case?
2018-01-18 02:33 AM
,
,
Hi,
first error was because on host (192.168.0.2) path was not good (tls/cert.pem).
Now, i have new error:
AT+S.HTTPGET=192.168.0.2,tls/cert.pem,443,2,,,ServerCert.pem,
,
AT-S.Skip CA,
AT-S.Skip CA,
AT-S.Loading:1:2,
AT-S.Loading:2:2,
AT-S.Loading:3:2,
AT-S.Http Server Status Code:400,
AT-S.Http Server Error:400,
AT-S.ERROR:111:Request failedon host, log server is:
certifs_1 , | 2018/01/17 17:50:32 [info] 6 ♯ 6: *2 client SSL certificate verify error: (21:unable to verify the first certificate) while reading client request headers, client: 192.168.0.1, server: , request: 'GET /tls/cert.pem HTTP/1.1', host: '192.168.0.2'
the problem is it the compatibility with spwf04sx ,supported ciphhers? PEM-encoded long term bundle containing 3 ECC
(
prime256v1 aka NIST P-256) certificates.
Thanks
Yoann
2018-01-18 03:31 AM
Hi Yoann,
from SPWF04Sx log, it seems the mutual authentication succeeded, whereas the HTTP server has refused the connection (Bad Request). Please note that the Http Server Status Code is received from HTTP server.
A TCP/TLS problem would be reported as Http Client Error/Certificate Error (a TLS error would be propagated back to the client).
Anyway, you can further diagnose the TLS connection by means of the SOCKON command. Following an example I have done on my module (1-way authentication):
- wrong certificate (CA certificate not found):
AT+S.HTTPGET=192.168.1.112,,443,2,,,,
AT-S.Certificate Error:23AT-S.Http Client Error:2AT-S.ERROR:111:Request failedAT+S.SOCKON=192.168.1.112,443,,s
AT-S.Certificate Error:23AT-S.ERROR:74:Failed to open socket- good certificate, page not found
AT+S.HTTPGET=192.168.1.129,,443,2,,,,
AT-S.Loading:1:1AT-S.Http Server Status Code:404AT-S.Http Server Error:404AT-S.ERROR:111:Request failedAT+S.SOCKON=192.168.1.129,443,,s
AT-S.Loading:1:1AT-S.On:192.168.1.129:0AT-S.OK+WIND:58:Socket Closed:0:0 <-- the connection was closed by the Apache HTTP server after a timeoutHope it helps, otherwise please send a wireshark log of the transaction.
Regards,
Elio
2018-01-18 11:15 AM
Hi,
i found my problem,
certificat is stored in flash system and i use cmd AT+S.FSP to read file. i use callback ind_wifi_file_data_available fct to store result and after init wifi module (AT+STLSCERT...) size certificate is 2642bytes and if result (AT+S.FSP) is stored in the middle of DMA buffer (4096), the certificate is bad (old string in the middle of buffer) Process_DMA_Buffer_Messages()
so with AT+S.TLSCERT i loaded a part of certificate (not full).
in debug step by step result (AT+S.FSP) is correct and i can load certificate in wifi module.
new:
i tested and i receive a GOOD log: ;-(
T+S.HTTPGET=192.168.0.2,tls/cert.pem,443,2,,,ServerCert.pem,
AT-S.Skip CAAT-S.Skip CAAT-S.Loading:1:2A+-S.Loading:2:2WIND:8:Hard Fault:TcpIp:47427153:08009a56:00000002:00000000:0806bd6b:0806c249:08097aee:21000000i need to fix the result of cmd AT+S.FSP to get full certificate but i would like to know why hard Fault.
link to size of file i download (> 2500bytes)
thanks
Yoann
2018-01-19 03:37 AM
To complet the message,
i tested with a download of file size 2500bytes and 300bytes = same error!
Show the message server side:
certifs_1 | 2018/01/19 10:30:17 [info] 6&sharp6: *5 client timed out (110: Operation timed out) while SSL handshaking, client: 192.168.0.1, server:
Do you have an idea on Hard Fault in the wifi module?
AT+S.HTTPGET=192.168.0.2,tls/priv.pem,443,2,,,ServerCert.pem,
AT-S.Skip CAAT-S.Skip CAAT-S.Loading:1:2A+-S.Loading:2:2WIND:8:Hard Fault:TcpIp:47427153:08009a56:00000002:00000000:0806bd6b:0806c249:08097aee:21000000Thanks
Yoann
2018-01-19 03:49 AM
After the reset:
AT+S.STS
AT-S.ListAT-S.Var:build=171117-0328fe3-SPWF04SAT-S.Var:fw_version=1.1.0AT-S.Var:boot_version=1.0AT-S.Var:var_version=2AT-S.Var:free_heap=38392AT-S.Var:min_heap=36504AT-S.Var:system_time=1516012536AT-S.Var:system_uptime=9AT-S.Var:system_sleeptime=0AT-S.Var:reset_reason=1AT-S.Var:startup=0AT-S.Var:random_number=460553785AT-S.Var:gpio_enable=0x0000AT-S.Var:app_fs=1AT-S.Var:ram_fs=1AT-S.Var:user_fs=0AT-S.Var:extvol_fs=0AT-S.Var:nv_power_cycles=13AT-S.Var:nv_wdog_resets=8AT-S.Var:nv_reset_cycles=204AT-S.Var:wifi_state=10AT-S.Var:wifi_own_macaddr=00:80:E1:BD:F0:17AT-S.Var:wifi_bssid=00:80:E1:BD:F0:17AT-S.Var:wifi_aid=0AT-S.Var:wifi_channelnum=1AT-S.Var:wifi_sup_rate_mask=0x003FFFCFAT-S.Var:wifi_bas_rate_mask=0x0000000FAT-S.Var:wifi_chan_activity=0x00001FFFAT-S.Var:wifi_max_tx_power=18AT-S.Var:wifi_gf_mode=0AT-S.Var:wifi_reg_country=AT-S.Var:wifi_dtim_period=0AT-S.Var:wifi_num_assoc=1AT-S.Var:ip_from_AutoIP=0AT-S.Var:ip_ipaddr=192.168.0.1AT-S.Var:ip_netmask=255.255.255.0AT-S.Var:ip_gw=0.0.0.0AT-S.Var:ip_dns1=0.0.0.0AT-S.Var:ip_dns2=208.67.220.220AT-S.Var:ip_linklocal=0:0:0:0:0:0:0:0AT-S.Var:ip_local=0:0:0:0:0:0:0:0AT-S.Var:ip_dns1v6=0:0:0:0:0:0:0:0AT-S.Var:ip_dns2v6=0:0:0:0:0:0:0:0AT-S.OKAT&V
AT-S.ListAT-S.Var:nv_manuf=STAT-S.Var:nv_model=SPWF04SCAT-S.Var:nv_serial=0317>30129AT-S.Var:nv_wifi_macaddr=00:80:E1:BD:F0:17AT-S.Var:standby_time=10AT-S.Var:standby_enabled=0AT-S.Var:sleep_enabled=0AT-S.Var:etf_mode=0AT-S.Var:blink_led=1AT-S.Var:ext_volume=3AT-S.Var:ramdisk_memsize=16AT-S.Var:aes128_key=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00AT-S.Var:user_desc=4231AT-S.Var:python_script=3:/uPython_test.pyAT-S.Var:python_memsize=32AT-S.Var:console_enabled=1AT-S.Var:console_speed=115200AT-S.Var:console_hwfc=0AT-S.Var:console_echo=1AT-S.Var:console_errs=2AT-S.Var:console_winds=2AT-S.Var:console_verbose=1AT-S.Var:console_repeater=0x21AT-S.Var:console_delimiter=0x2CAT-S.Var:console_wind_off_low=0x00000000AT-S.Var:console_wind_off_medium=0x00000000AT-S.Var:console_wind_off_high=0x00000000AT-S.Var:wifi_tx_msdu_lifetime=0AT-S.Var:wifi_rx_msdu_lifetime=0AT-S.Var:wifi_operational_mode=0x00000011AT-S.Var:wifi_beacon_wakeup=1AT-S.Var:wifi_beacon_interval=100AT-S.Var:wifi_listen_interval=0AT-S.Var:wifi_rts_threshold=3000AT-S.Var:wifi_ssid=48:52:50:33:32:31:36:35:34:37:38:39:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00AT-S.Var:wifi_ssid_len=12AT-S.Var:wifi_txfail_thresh=5AT-S.Var:wifi_dtim_period=1AT-S.Var:wifi_add_tim_ie=0AT-S.Var:wifi_region=1AT-S.Var:wifi_ht_mode=1AT-S.Var:wifi_channelnum=1AT-S.Var:wifi_opr_rate_mask=0x003FFFCFAT-S.Var:wifi_bas_rate_mask=0x0000000FAT-S.Var:wifi_mode=3AT-S.Var:wifi_auth_type=0AT-S.Var:wifi_atim_window=0AT-S.Var:wifi_powersave=0AT-S.Var:wifi_tx_power=18AT-S.Var:wifi_rssi_thresh=0AT-S.Var:wifi_rssi_hyst=0AT-S.Var:wifi_ap_idle_timeout=120AT-S.Var:wifi_beacon_loss_thresh=10AT-S.Var:wifi_priv_mode=0AT-S.Var:wifi_wep_keys[0]=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00AT-S.Var:wifi_wep_keys[1]=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00AT-S.Var:wifi_wep_keys[2]=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00AT-S.Var:wifi_wep_keys[3]=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00AT-S.Var:wifi_wep_key_lens=00:00:00:00AT-S.Var:wifi_wep_default_key=0AT-S.Var:wifi_wpa_psk_raw=00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00AT-S.Var:wifi_wpa_psk_text=AT-S.Var:wifi_eap_identity=identityAT-S.Var:
mailto:wifi_eap_anon_identity=anonymous@identity.org
AT-S.Var:wifi_eap_passwd=passwordAT-S.Var:wifi_eap_type=0AT-S.Var:wifi_eap_skip_datechecks=0AT-S.Var:wifi_wps_walk_time=120AT-S.Var:wifi_wps_pin=1234567AT-S.Var:ip_sock_memsize=1AT-S.Var:ip_sock_threshold=0AT-S.Var:ip_dhcp_lease_time=120AT-S.Var:ip_macfilter=00:00:00:00:00:00AT-S.Var:ip_num_clients=1AT-S.Var:ip_allow_port_scans=1AT-S.Var:ip_use_v6=1AT-S.Var:ip_use_dhcpd=1AT-S.Var:ip_use_httpd=1AT-S.Var:ip_use_tftpd=1AT-S.Var:ip_use_dhcpc=1AT-S.Var:ip_hostname=iwm-BD-F0-17AT-S.Var:ip_apdomainname=AT-S.Var:ip_apredirect=AT-S.Var:ip_ipaddr=192.168.0.1AT-S.Var:ip_netmask=255.255.255.0AT-S.Var:ip_gw=0.0.0.0AT-S.Var:ip_dns1=0.0.0.0AT-S.Var:ip_dns2=208.67.220.220AT-S.Var:ip_local=0:0:0:0:0:0:0:0AT-S.Var:ip_dns1v6=0:0:0:0:0:0:0:0AT-S.Var:ip_dns2v6=0:0:0:0:0:0:0:0AT-S.Var:ip_dhcp_timeout=20AT-S.Var:ip_ntp_server1=ptbtime1.ptb.deAT-S.Var:ip_ntp_server2=ntp0.ipv6.fau.deAT-S.Var:ip_ntp_refresh=3600AT-S.Var:ip_ntp_startup=1AT-S.Var:ip_mdns_domain_name=SPWF04S-DefaultAT-S.Var:ip_mdns_device_name_ttl=120AT-S.Var:ip_mdns_services_name=SPWF04S-WebSrv SPWF04S-TFTPSrvAT-S.Var:ip_mdns_services_prot=_http._tcp _tftp._udpAT-S.Var:ip_mdns_services_keys=dev1 dev2AT-S.Var:ip_mdns_services_vals=number1 number2AT-S.Var:ip_mdns_services_port=80 69AT-S.Var:ip_mdns_services_ttl=120 60AT-S.Var:ip_mdns_startup=01:01AT-S.OK2018-01-19 05:04 AM
Hi Yoann,
as stated in the Security application note (AN4963) the maximum allowed size for certificates/key is 2.5KB.
You may save the certificates in any of the filesystems, that will anyway lead to handshake failure but will prevent from getting the WIND:8.
In a previous comment you wrote 'PEM-encoded long term bundle containing 3 ECC ( prime256v1 aka NIST P-256) certificates.', so I understood that the certificate you are loading in cert section is composed by a chain of 3 ECC certificate (SPWF04S's cert + intermediate CA cert + Root CA cert).
If this is your case, this kind of certificate is actually supported and you should load the concatenation of module's certificate (PEM encoded) + intermediate CA certificate (PEM encoded) in the cert section in flash (or tls.cert on filesystem), while the respective Root CA cert should be in the availability of the peer (the HTTP server on your PC). I'm a bit surprised that the chain of two ECC certificates exceeds 2.5KB (even though possible if the certificates include lot of info...).
Could you please confirm the certificate does not include the Root CA certificate?
2018-01-19 07:51 AM
Hi,
the certificate i am loading in cert section is composed by a chain of 3 ECC certificate (SPWF04S's cert + intermediate or site CA cert + delegate CA cert). Not Root CA cert!
i already validated bundle certificate with a socket with size < 2.5KB
I will test with certificate < 2.5KB to check if i have same pb.
So i confirm certificat does not include the root CA.
Thks
Yoann
2018-01-19 09:20 AM
Hi,
this explain the size of certificate... This kind of certificate is also supported if it's size is less than 2.5K.
Unfortunately, I don't see a way to reduce the size of your certificate, since the only method supported by SPWF04S to concatenate certificates is to PEM encode each of them.
Regards,
Elio