TLS1.2 and api.amazon.com

[Matti Sillanpaa]

Posted on April 11, 2017 at 15:57

Hi.

I'm trying to communicate with api.amazon over SPWFSA01. Amazon requires secure communication, so I'm trying to put amazon approved certificate (got it from here:

https://www.amazontrust.com/repository/

). However I now got 'ERROR: Unable to load CA certificate' as I try to open the socket. Am I totally wrong here and should I generate the certificate by myself? I mean I understood from what I've read here and amazon that I should use amazon approved keys in the client side?

Whole trace of the situation:

+WIND:1:Poweron (170111-665d284-SPWF01S)

+WIND:13:ST SPWF01SA1 IWM: Copyright (c) 2012-2016 STMicroelectronics, Inc. All rights Reserved.

+WIND:46:WPA: Crunching PSK...

+WIND:32:WiFi Hardware StartedCMD: AT+S.TLSCERT2=clean,all

OK

CMD: AT+S.SETTIME=1491917021

OK

CMD: AT+S.TLSCERT=f_ca,13api.amazon.com

CMD: AT+S.TLSCERT=f_cert,1207

-----BEGIN CERTIFICATE-----MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsFADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTELMAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXjca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qwIFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQmjgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUAA4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDIU5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUsN+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vvo/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpyrqXRfboQnoZsG4q5WTP468SQvvG5-----END CERTIFICATE-----OK

CMD: AT+S.TLSCERT=f_key,63

fbe3018031f9586bcbf41727e417b7d1c45c2f47f93be372a17b96b50757d5a2

OK

+WIND:19:WiFi Join:xx:xx:xx:xx:xx:xxOK+WIND:25:WiFi Association with 'TPNY' successful+WIND:51:WPA Handshake CompleteOK+WIND:24:WiFi Up:192.168.0.102

CMD: AT+S.SOCKON=api.amazon.com,443,s,ind

ERROR: Unable to load CA certificate

[Gerardo GALLUCCI]

Posted on April 11, 2017 at 18:47

Ciao Matti,

I think 'AT+S.TLSCERT=f_ca,13<cr>

api.amazon.com' is wrong. I mean, I expect '

api.amazon.com

' is the server domain name, not the CA. Use 'AT+S.TLSCERT=f_domain,13<cr>

api.amazon.com

' instead.

About CA, please download proper certificate, and load it inside the module using f_ca option.

Worst case, you'll get an 'unable to connect', and not an 'unable to load certificate'!

Let me know...

jerry

[Matti Sillanpaa]

Posted on April 12, 2017 at 09:39

Few extra questions here:

1. the certificate line changes. I'm using \n after each line. Should there be any (so one long string) or should there be both \r\n or something?

2. They certificate type. the one I'm using is so called CA root certificate. I'm using it directly so is it the problem here? Or should I generate something from it to connect amazon. I mean if just command line curl works OK with the api.amazon.com I would assume that very special certificate stuff isn't needed.

[Matti Sillanpaa]

Posted on April 12, 2017 at 13:31

Thanks for the pointer.

However regarding the certificate. Shouldn't the certificate only concern the case where this acts as server? I mean shouldn't this sort of client->server communication require security key (rsa-2048) or something like that? Or is that covered?

I'm trying to emulate curl here to get access token from amazon. I mean I don't have any specific certificates set to my linux and curl works just fine.

[Gerardo GALLUCCI]

Posted on April 12, 2017 at 16:50

Hi,

there are 3 authentication methods:

- anonymous: no certificates are needed

- one_way: f_ca must be loaded

- muthual: all certificates are needed

please ref. to AN4683

: Transport layer security protocol for SPWF01Sx module 

http://www.st.com/resource/en/application_note/dm00176553.pdf

 for details on certificate usage. Check your server to know which autentication is required.

[Matti Sillanpaa]

Posted on April 13, 2017 at 09:45

With new 3.0.0 drivers from SW and fully disconnecting & rebooting the SPWF01 I now have the communication working. No sertificates or such were required. Thanks for the support.