Skip to content

ESP32: Investigation necessarry: is SSL CA/Chain really validated without providing a CA ? #18

@adelin-mcbsoft

Description

@adelin-mcbsoft

Hi Gil,

Me again (and again, and again). :D
I just want to bring to your attention and old discussed issue, regarding the SSL Certificate and Handshaking, on ESP32.

Situation 1: When not using any sort of certificate but using an WSS (secure) server/URL, the debug messages report that the certificate is verified, though I don't provide any CA resource (as browsers do).

Situation 2: When I provide a good CA along with the client.setCAcert() method, the verification passes as well.

(messages for both situation 1 and 2):

[V][ssl_client.cpp:53] start_ssl_client(): Free internal heap before TLS 277372
[V][ssl_client.cpp:55] start_ssl_client(): Starting socket
[V][ssl_client.cpp:90] start_ssl_client(): Seeding the random number generator
[V][ssl_client.cpp:99] start_ssl_client(): Setting up the SSL/TLS structure...
[V][ssl_client.cpp:112] start_ssl_client(): Loading CA cert
[V][ssl_client.cpp:177] start_ssl_client(): Setting hostname for TLS session...
[V][ssl_client.cpp:192] start_ssl_client(): Performing the SSL/TLS handshake...
[V][ssl_client.cpp:213] start_ssl_client(): Verifying peer X.509 certificate...
[V][ssl_client.cpp:222] start_ssl_client(): Certificate verified.
[V][ssl_client.cpp:237] start_ssl_client(): Free internal heap after TLS 236048

Situation 3: However, when I provide a wrong CA resource (e.g. an invalid CA root cert.), the handshaking fails (as it should).

The question is: When not providing a CA resource (Situation 1), does the library verifies indeed the certificate in any way or not? Does it connect remotely to the CA Roots and verifies it? I guess this ssl_client is inherited by Espressifs library...

I tested the above situations with an LetsEncrypt certificate along its roots ( https://letsencrypt.org/certificates/ ).

Many thanks,
Best,

A.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions