Skip to content

Commit 646bdfc

Browse files
d-a-vd-a-v
authored
SSL examples: updates (#8643)
Simplify SSL+ethernet example, reuse/include WiFi example
1 parent e2a36ed commit 646bdfc

File tree

7 files changed

+107
-297
lines changed

7 files changed

+107
-297
lines changed

Diff for: ‎libraries/ESP8266WiFi/examples/BearSSL_Validation/BearSSL_Validation.ino

+19-12
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@
1010
#include <time.h>
1111
#include "certs.h"
1212

13+
#define FINGERPRINT fingerprint_www_example_org
14+
#define PUBKEY pubkey_www_example_org
15+
#define CERT cert_DigiCert_TLS_RSA_SHA256_2020_CA1
16+
1317
#ifndef STASSID
1418
#define STASSID "your-ssid"
1519
#define STAPSK "your-password"
@@ -87,7 +91,7 @@ If there are no CAs or insecure options specified, BearSSL will not connect.
8791
Expect the following call to fail as none have been configured.
8892
)EOF");
8993
BearSSL::WiFiClientSecure client;
90-
fetchURL(&client, gitlab_host, gitlab_port, path);
94+
fetchURL(&client, SSL_host, SSL_port, path);
9195
}
9296

9397
void fetchInsecure() {
@@ -98,7 +102,7 @@ which is subject to man-in-the-middle (MITM) attacks.
98102
)EOF");
99103
BearSSL::WiFiClientSecure client;
100104
client.setInsecure();
101-
fetchURL(&client, gitlab_host, gitlab_port, path);
105+
fetchURL(&client, SSL_host, SSL_port, path);
102106
}
103107

104108
void fetchFingerprint() {
@@ -111,8 +115,8 @@ fingerprints will change if anything changes in the certificate chain
111115
the root authorities, etc.).
112116
)EOF");
113117
BearSSL::WiFiClientSecure client;
114-
client.setFingerprint(fingerprint_sni_cloudflaressl_com);
115-
fetchURL(&client, gitlab_host, gitlab_port, path);
118+
client.setFingerprint(FINGERPRINT);
119+
fetchURL(&client, SSL_host, SSL_port, path);
116120
}
117121

118122
void fetchSelfSigned() {
@@ -137,9 +141,9 @@ private and not shared. A MITM without the private key would not be
137141
able to establish communications.
138142
)EOF");
139143
BearSSL::WiFiClientSecure client;
140-
BearSSL::PublicKey key(pubkey_sni_cloudflaressl_com);
144+
BearSSL::PublicKey key(PUBKEY);
141145
client.setKnownKey(&key);
142-
fetchURL(&client, gitlab_host, gitlab_port, path);
146+
fetchURL(&client, SSL_host, SSL_port, path);
143147
}
144148

145149
void fetchCertAuthority() {
@@ -153,14 +157,14 @@ BearSSL does verify the notValidBefore/After fields.
153157
)EOF");
154158

155159
BearSSL::WiFiClientSecure client;
156-
BearSSL::X509List cert(cert_Cloudflare_Inc_ECC_CA_3);
160+
BearSSL::X509List cert(CERT);
157161
client.setTrustAnchors(&cert);
158162
Serial.printf("Try validating without setting the time (should fail)\n");
159-
fetchURL(&client, gitlab_host, gitlab_port, path);
163+
fetchURL(&client, SSL_host, SSL_port, path);
160164

161165
Serial.printf("Try again after setting NTP time (should pass)\n");
162166
setClock();
163-
fetchURL(&client, gitlab_host, gitlab_port, path);
167+
fetchURL(&client, SSL_host, SSL_port, path);
164168
}
165169

166170
void fetchFaster() {
@@ -171,20 +175,23 @@ you won't want to do this. If you need to maximize battery life, these
171175
may make sense
172176
)EOF");
173177
BearSSL::WiFiClientSecure client;
178+
Serial.printf("Insecure, all ciphers:\n");
174179
client.setInsecure();
175180
uint32_t now = millis();
176-
fetchURL(&client, gitlab_host, gitlab_port, path);
181+
fetchURL(&client, SSL_host, SSL_port, path);
177182
uint32_t delta = millis() - now;
183+
Serial.printf("Insecure, less secure ciphers:\n");
178184
client.setInsecure();
179185
client.setCiphersLessSecure();
180186
now = millis();
181-
fetchURL(&client, gitlab_host, gitlab_port, path);
187+
fetchURL(&client, SSL_host, SSL_port, path);
182188
uint32_t delta2 = millis() - now;
189+
Serial.printf("Insecure, few ciphers:\n");
183190
std::vector<uint16_t> myCustomList = { BR_TLS_RSA_WITH_AES_256_CBC_SHA256, BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA };
184191
client.setInsecure();
185192
client.setCiphers(myCustomList);
186193
now = millis();
187-
fetchURL(&client, gitlab_host, gitlab_port, path);
194+
fetchURL(&client, SSL_host, SSL_port, path);
188195
uint32_t delta3 = millis() - now;
189196
Serial.printf("Using more secure: %dms\nUsing less secure ciphers: %dms\nUsing custom cipher list: %dms\n", delta, delta2, delta3);
190197
}

Diff for: ‎libraries/ESP8266WiFi/examples/BearSSL_Validation/certUpdate

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
cd ${0%/*} 2>/dev/null
2-
python3 ../../../../tools/cert.py -s www.gitlab.com -n gitlab > certs.h
2+
python3 ../../../../tools/cert.py -s www.example.com -n SSL > certs.h

Diff for: ‎libraries/ESP8266WiFi/examples/BearSSL_Validation/certs.h

+79-39
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,98 @@
11

22
// this file is autogenerated - any modification will be overwritten
33
// unused symbols will not be linked in the final binary
4-
// generated on 2022-07-18 22:01:02
5-
// by ['../../../../tools/cert.py', '-s', 'www.gitlab.com', '-n', 'gitlab']
4+
// generated on 2022-07-20 14:09:01
5+
// by ['../../../../tools/cert.py', '-s', 'www.example.com', '-n', 'SSL']
66

77
#pragma once
88

99
////////////////////////////////////////////////////////////
10-
// certificate chain for www.gitlab.com:443
10+
// certificate chain for www.example.com:443
1111

12-
const char* gitlab_host = "www.gitlab.com";
13-
const uint16_t gitlab_port = 443;
12+
const char* SSL_host = "www.example.com";
13+
const uint16_t SSL_port = 443;
1414

15-
// CN: sni.cloudflaressl.com => name: sni_cloudflaressl_com
16-
// not valid before: 2021-09-11 00:00:00
17-
// not valid after: 2022-09-10 23:59:59
18-
const char fingerprint_sni_cloudflaressl_com [] PROGMEM = "04:86:fa:e7:69:4e:7b:75:f4:fd:88:41:6e:42:7a:f1:b0:de:66:3c";
19-
const char pubkey_sni_cloudflaressl_com [] PROGMEM = R"PUBKEY(
15+
// CN: www.example.org => name: www_example_org
16+
// not valid before: 2022-03-14 00:00:00
17+
// not valid after: 2023-03-14 23:59:59
18+
const char fingerprint_www_example_org [] PROGMEM = "df:81:df:a6:b6:1e:af:df:ff:fe:1a:25:02:40:db:5d:2e:6c:ee:25";
19+
const char pubkey_www_example_org [] PROGMEM = R"PUBKEY(
2020
-----BEGIN PUBLIC KEY-----
21-
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELIhZBDGe53N84LRh6Ng9qPCZ4VQ6
22-
2yUXTqkR7C+0e3sd+8GGLp67mLuFOvtjcrv+tP5o8zCz+UpDHmj7n1n17A==
21+
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlV2WY5rlGn1fpwvuBhj0
22+
nVBcNxCxkHUG/pJG4HvaJen7YIZ1mLc7/P4snOJZiEfwWFTikHNbcUCcYiKG8JkF
23+
ebZOYMc1U9PiEtVWGU4kuYuxiXpD8oMPin1B0SgrF7gKfO1//I2weJdAUjgZuXBC
24+
PAlhz2EnHddzXUtwm9XuOLO/Y6LATVMsbp8/lXnfo/bX0UgJ7C0aVqOu07A0Vr6O
25+
kPxwWmOvF3cRKhVCM7U4B51KK+IsWRLm8cVW1IaXjwhGzW7BR6EI3sxCQ4Wnc6HV
26+
PSgmomLWWWkIGFPAwcWUB4NC12yhCO5iW/dxNMWNLMRVtnZAyq6FpZ8wFK6j4OMw
27+
MwIDAQAB
2328
-----END PUBLIC KEY-----
2429
)PUBKEY";
2530
26-
// http://cacerts.digicert.com/CloudflareIncECCCA-3.crt
27-
// CN: Cloudflare Inc ECC CA-3 => name: Cloudflare_Inc_ECC_CA_3
28-
// not valid before: 2020-01-27 12:48:08
29-
// not valid after: 2024-12-31 23:59:59
30-
const char cert_Cloudflare_Inc_ECC_CA_3 [] PROGMEM = R"CERT(
31+
// http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt
32+
// CN: DigiCert TLS RSA SHA256 2020 CA1 => name: DigiCert_TLS_RSA_SHA256_2020_CA1
33+
// not valid before: 2021-04-14 00:00:00
34+
// not valid after: 2031-04-13 23:59:59
35+
const char cert_DigiCert_TLS_RSA_SHA256_2020_CA1 [] PROGMEM = R"CERT(
3136
-----BEGIN CERTIFICATE-----
32-
MIIDzTCCArWgAwIBAgIQCjeHZF5ftIwiTv0b7RQMPDANBgkqhkiG9w0BAQsFADBa
33-
MQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJl
34-
clRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTIw
35-
MDEyNzEyNDgwOFoXDTI0MTIzMTIzNTk1OVowSjELMAkGA1UEBhMCVVMxGTAXBgNV
36-
BAoTEENsb3VkZmxhcmUsIEluYy4xIDAeBgNVBAMTF0Nsb3VkZmxhcmUgSW5jIEVD
37-
QyBDQS0zMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEua1NZpkUC0bsH4HRKlAe
38-
nQMVLzQSfS2WuIg4m4Vfj7+7Te9hRsTJc9QkT+DuHM5ss1FxL2ruTAUJd9NyYqSb
39-
16OCAWgwggFkMB0GA1UdDgQWBBSlzjfq67B1DpRniLRF+tkkEIeWHzAfBgNVHSME
40-
GDAWgBTlnVkwgkdYzKz6CFQ2hns6tQRN8DAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0l
41-
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8CAQAwNAYI
42-
KwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5j
43-
b20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09t
44-
bmlyb290MjAyNS5jcmwwbQYDVR0gBGYwZDA3BglghkgBhv1sAQEwKjAoBggrBgEF
45-
BQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzALBglghkgBhv1sAQIw
46-
CAYGZ4EMAQIBMAgGBmeBDAECAjAIBgZngQwBAgMwDQYJKoZIhvcNAQELBQADggEB
47-
AAUkHd0bsCrrmNaF4zlNXmtXnYJX/OvoMaJXkGUFvhZEOFp3ArnPEELG4ZKk40Un
48-
+ABHLGioVplTVI+tnkDB0A+21w0LOEhsUCxJkAZbZB2LzEgwLt4I4ptJIsCSDBFe
49-
lpKU1fwg3FZs5ZKTv3ocwDfjhUkV+ivhdDkYD7fa86JXWGBPzI6UAPxGezQxPk1H
50-
goE6y/SJXQ7vTQ1unBuCJN0yJV0ReFEQPaA1IwQvZW+cwdFD19Ae8zFnWSfda9J1
51-
CZMRJCQUzym+5iPDuI9yP+kHyCREU3qzuWFloUwOxkgAyXVjBYdwRVKD05WdRerw
52-
6DEdfgkfCv4+3ao8XnTSrLE=
37+
MIIEvjCCA6agAwIBAgIQBtjZBNVYQ0b2ii+nVCJ+xDANBgkqhkiG9w0BAQsFADBh
38+
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
39+
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
40+
QTAeFw0yMTA0MTQwMDAwMDBaFw0zMTA0MTMyMzU5NTlaME8xCzAJBgNVBAYTAlVT
41+
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxKTAnBgNVBAMTIERpZ2lDZXJ0IFRMUyBS
42+
U0EgU0hBMjU2IDIwMjAgQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
43+
AQEAwUuzZUdwvN1PWNvsnO3DZuUfMRNUrUpmRh8sCuxkB+Uu3Ny5CiDt3+PE0J6a
44+
qXodgojlEVbbHp9YwlHnLDQNLtKS4VbL8Xlfs7uHyiUDe5pSQWYQYE9XE0nw6Ddn
45+
g9/n00tnTCJRpt8OmRDtV1F0JuJ9x8piLhMbfyOIJVNvwTRYAIuE//i+p1hJInuW
46+
raKImxW8oHzf6VGo1bDtN+I2tIJLYrVJmuzHZ9bjPvXj1hJeRPG/cUJ9WIQDgLGB
47+
Afr5yjK7tI4nhyfFK3TUqNaX3sNk+crOU6JWvHgXjkkDKa77SU+kFbnO8lwZV21r
48+
eacroicgE7XQPUDTITAHk+qZ9QIDAQABo4IBgjCCAX4wEgYDVR0TAQH/BAgwBgEB
49+
/wIBADAdBgNVHQ4EFgQUt2ui6qiqhIx56rTaD5iyxZV2ufQwHwYDVR0jBBgwFoAU
50+
A95QNVbRTLtm8KPiGxvDl7I90VUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQG
51+
CCsGAQUFBwMBBggrBgEFBQcDAjB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGG
52+
GGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBABggrBgEFBQcwAoY0aHR0cDovL2Nh
53+
Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNydDBCBgNV
54+
HR8EOzA5MDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRH
55+
bG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwCwYJYIZIAYb9bAIBMAcGBWeBDAEB
56+
MAgGBmeBDAECATAIBgZngQwBAgIwCAYGZ4EMAQIDMA0GCSqGSIb3DQEBCwUAA4IB
57+
AQCAMs5eC91uWg0Kr+HWhMvAjvqFcO3aXbMM9yt1QP6FCvrzMXi3cEsaiVi6gL3z
58+
ax3pfs8LulicWdSQ0/1s/dCYbbdxglvPbQtaCdB73sRD2Cqk3p5BJl+7j5nL3a7h
59+
qG+fh/50tx8bIKuxT8b1Z11dmzzp/2n3YWzW2fP9NsarA4h20ksudYbj/NhVfSbC
60+
EXffPgK2fPOre3qGNm+499iTcc+G33Mw+nur7SpZyEKEOxEXGlLzyQ4UfaJbcme6
61+
ce1XR2bFuAJKZTRei9AqPCCcUZlM51Ke92sRKw2Sfh3oius2FkOH6ipjv3U/697E
62+
A7sKPPcw7+uvTPyLNhBzPvOk
5363
-----END CERTIFICATE-----
5464
)CERT";
5565
56-
// end of certificate chain for www.gitlab.com:443
66+
// http://cacerts.digicert.com/DigiCertGlobalRootCA.crt
67+
// CN: DigiCert Global Root CA => name: DigiCert_Global_Root_CA
68+
// not valid before: 2006-11-10 00:00:00
69+
// not valid after: 2031-11-10 00:00:00
70+
const char cert_DigiCert_Global_Root_CA [] PROGMEM = R"CERT(
71+
-----BEGIN CERTIFICATE-----
72+
MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
73+
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
74+
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
75+
QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
76+
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
77+
b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
78+
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
79+
CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
80+
nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
81+
43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
82+
T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
83+
gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
84+
BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
85+
TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
86+
DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
87+
hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
88+
06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
89+
PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
90+
YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
91+
CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
92+
-----END CERTIFICATE-----
93+
)CERT";
94+
95+
96+
// end of certificate chain for www.example.com:443
5797
////////////////////////////////////////////////////////////
5898

0 commit comments

Comments
 (0)