--
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+...@arduino.cc.
--
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/b15d2122-a48d-4e28-b1c1-2e0cbd84e8c3n%40arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMgqHM_CuNCP3MH%2BOx8JMO%2BPvbQLKWG_YakdX8oxz9fhxQ%40mail.gmail.com.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMgqHM_CuNCP3MH%2BOx8JMO%2BPvbQLKWG_YakdX8oxz9fhxQ%40mail.gmail.com.
Happy to share https and mqtt examples using the Arduino libraries if it's useful, I use them a lot. All variations on the same theme:
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ81hcG90TcRFWPYgVB0_1a%2BeFPsKHQOD%3DTDkhDET17yng%40mail.gmail.com.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMg5bH5aENx7%3D%2BSzoUcN0DtwiNL2pYOLWb%3Dj40dndsFreQ%40mail.gmail.com.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ8g0QW1OCa-KyMBVOu1yeRi%3DQD1i9cOQ%3D6E4vfChB3wbQ%40mail.gmail.com.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMiOP4kV2wxmK_Gz_SeKuuRnq_3Oj0Duk%2Bgix5foJE8_yg%40mail.gmail.com.
Someone on the current dev team should comment here rather than me becuase I'm not as current on the maintenance of the WIFi101 and WiFiNINA libs, but what I can tell you is this:
For http and https, I use the ArduinoHttpClient lib, which is a fork of Adrian McEwen's excellent http client lib. It uses the WiFi101 or wifiNINA libs under the hood. They both have a class called wifiSSLclient which handles all the SSL work for me, including interaction with the crypto
chip. The certificates in the crypto chip when it ships have always worked for sites I needed. So I've never really bothered to upload certs through the firmware updater and cert loader tool other than to learn how to use it. This section of that guide may help you. To be honest, I forget what cert is loaded on when the boards ship, but hopefully someone on the dev team who currently maintains the Wifi boards can say.Tom
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ_QZwgf8mr4jWBmceavvYKWwq2gAp_Co0-qPFMuoVGzQA%40mail.gmail.com.
Yes, I've looked through the WiFiSSLClient and WiFiClient code. I don't know 100% how it works, but a little. I don't think any of the "user" code, ie. code in ~/Arduino/libraries has any iteraction with the crypto chip and cert manipulation. I believe that is in the Client firmware. Perhaps I am wrong.
I'm writing based upon memory and even then its complicated. I'm basing this on the fact that I saw socket options for SSL being set in the "user" code but nothing more.
I did use put the Https Client code I used in the github and the results of it connecting to google with and without the google.com:443 entry in the utility.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMhWBceoaGgxh_EM%3DtDYa%2B8f8_NsBAueFLtu09rL%3Dfrsmg%40mail.gmail.com.
On Thu, Aug 12, 2021, 10:31 AM John Davis <dav...@gmail.com> wrote:Yes, I've looked through the WiFiSSLClient and WiFiClient code. I don't know 100% how it works, but a little. I don't think any of the "user" code, ie. code in ~/Arduino/libraries has any iteraction with the crypto chip and cert manipulation. I believe that is in the Client firmware. Perhaps I am wrong.Hmm... I thought the WiFiBearSSL lib, which is used by the lib, accessed the ECCx08 lib, but I have to defer to the devs on that.
I'm writing based upon memory and even then its complicated. I'm basing this on the fact that I saw socket options for SSL being set in the "user" code but nothing more.The main diff for me is generally using the WiFiSSLClient instead of WiFiClient and changing the port. That's why I assumed the above about the crypto lib.
I did use put the Https Client code I used in the github and the results of it connecting to google with and without the google.com:443 entry in the utility.This might be the problem. For the server path, you don't want to include the port. That is set separately, see my examples for that. That's a common mistake I see students make. Similarly, don't include the http or https in your server path. The client lib adds those too, depending on whether you're using the SSL or ain client.
Does that help at all? I feel like I'm off base here.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ9FA8qTowPU8SFchzzVE-%2BUXsC5LtydZS-m3RiKYWWmdg%40mail.gmail.com.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMhS%3DLf6daFjMZorr2UjzxbEPBt7NScnUDwtGMG9enO2eQ%40mail.gmail.com.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ9U9YYDhDXJoAZ19nhWW%3DLb5LCN21xNeXuTTyhE5hTb3A%40mail.gmail.com.
Tom
Comments inline
Tom
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/b15d2122-a48d-4e28-b1c1-2e0cbd84e8c3n%40arduino.cc.
--John F. Davis--
6 Kandes Court
Durham, NC 27713
919-888-8358
Public Profile https://www.linkedin.com/in/netskink
独树一帜
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
--To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMgqHM_CuNCP3MH%2BOx8JMO%2BPvbQLKWG_YakdX8oxz9fhxQ%40mail.gmail.com.
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ81hcG90TcRFWPYgVB0_1a%2BeFPsKHQOD%3DTDkhDET17yng%40mail.gmail.com.
--John F. Davis--
6 Kandes Court
Durham, NC 27713
919-888-8358
Public Profile https://www.linkedin.com/in/netskink
独树一帜
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
--To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMg5bH5aENx7%3D%2BSzoUcN0DtwiNL2pYOLWb%3Dj40dndsFreQ%40mail.gmail.com.
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ8g0QW1OCa-KyMBVOu1yeRi%3DQD1i9cOQ%3D6E4vfChB3wbQ%40mail.gmail.com.
--John F. Davis--
6 Kandes Court
Durham, NC 27713
919-888-8358
Public Profile https://www.linkedin.com/in/netskink
独树一帜
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMiOP4kV2wxmK_Gz_SeKuuRnq_3Oj0Duk%2Bgix5foJE8_yg%40mail.gmail.com.
--
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ_QZwgf8mr4jWBmceavvYKWwq2gAp_Co0-qPFMuoVGzQA%40mail.gmail.com.
--John F. Davis
6 Kandes Court
Durham, NC 27713
919-888-8358
Public Profile https://www.linkedin.com/in/netskink
独树一帜
--
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMhWBceoaGgxh_EM%3DtDYa%2B8f8_NsBAueFLtu09rL%3Dfrsmg%40mail.gmail.com.
--
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAKpfLQ9FA8qTowPU8SFchzzVE-%2BUXsC5LtydZS-m3RiKYWWmdg%40mail.gmail.com.
--John F. Davis
6 Kandes Court
Durham, NC 27713
919-888-8358
Public Profile https://www.linkedin.com/in/netskink
独树一帜
--
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
To view this discussion on the web visit https://groups.google.com/a/arduino.cc/d/msgid/developers/CAEaoPMhS%3DLf6daFjMZorr2UjzxbEPBt7NScnUDwtGMG9enO2eQ%40mail.gmail.com.
--
You received this message because you are subscribed to the Google Groups "Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to developers+unsubscribe@arduino.cc.
Hi,not had time to look at your repo but jumping in to provide some clarifications:
- ArduinoBearSSL library implements SSL and has a list of trusted anchors that may not contain the root CA your certificate has been issued with. the reason for this is that embedded devices have small memory and we tried to keep the size small. you can of course add your own trusted CA in there at any time. you can look at this commit for an example on how to do it (Add DigitCertGlobalRootCA as trust anchor · arduino-libraries/ArduinoBearSSL@026f174 (github.com))
- cryptochip is used only for client authentication to a server. the way it works is that for example when connecting to Arduino IoT Cloud the client authenticates the server checking if its certificate was issued by a trusted root CA AND the server authenticates the client using the certificate that's stored in the crypto. this last part is important because the certificate never exits the crypto and bearSSL has been modified to send challenges to crypto and receive ecnrypted responses from it. if you had the certificate in your code some one could extract it in a much easier way than it could from the crypto
- in most recent versions of our libraries we switched to SSL offloading on modems. this is happening both on MKRWiFi1010 (where SSL stack is running on Nina wifi module) and MKR GSM (where we use the SSL AT commands from the modem). this means that for these versions we can get rid of bearSSL greatly reducing the usage of flash and, most importantly RAM which i a very scarce resource in SAMD21
Dario
Tom