wolfSSL - Embedded SSL Library — error = -188, ASN no signer error to confirm failure

Re: error = -188, ASN no signer error to confirm failure

null@example.com (johnot) — Fri, 17 Mar 2023 04:43:27 +0000

Try this.

Create a callback for the peer verification to bypass the failure. Returning 1 allows the client to accept any certificate, hence bypassing the certificate verification failure.

int wolfssl_verify_cb(int, WOLFSSL_X509_STORE_CTX*)
{
    return 1;
}

void your_function()
{
    // ...
    SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, wolfssl_verify_cb);
    // ...
}

NOTE: From my experience, wolfSSL uses the callback provided through `SSL_CTX_set_verify`, not `SSL_CTX_set_cert_verify_callback`. I haven't dug through the code completely, but those functions set 2 different variables. I believe the CB variable in `SSL_CTX_set_verify` is the one that gets called when the verification fails.

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 19:50:25 +0000

Ok, so you are now having success with our example client. You can now use that as a template to better understand what you need to do. Since you mentioned embedded, please do consider tiny curl. It just might fit your use case!

Warm regards, Anthony

Re: error = -188, ASN no signer error to confirm failure

null@example.com (msorage) — Wed, 08 Mar 2023 19:09:56 +0000

I downloaded wolfssl-5.5.4 and tried ./examples/client/client -h www.wolfssl.com -p 443 --sys-ca-certs again.

./examples/client/client -h www.wolfssl.com -p 443 --sys-ca-certs
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SSL curve name is SECP256R1

but no progress with my code and github example.

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 18:03:21 +0000

Hi msorage,

There is some sort of problem here. Your debug output indicates you only processed 2 certificates. You should have processed all the certificates in the /etc/ssl/certs.

Please use a debugger to figure why that hasn't happened.

Warm regards , Anthony

Re: error = -188, ASN no signer error to confirm failure

null@example.com (msorage) — Wed, 08 Mar 2023 17:25:34 +0000

./examples/client/client -h www.wolfssl.com -p 443 --sys-ca-certs
wolfSSL Entering wolfSSL_Init
wolfSSL Entering wolfCrypt_Init
wolfSSL Entering TLSv1_2_client_method_ex
wolfSSL Entering wolfSSL_CTX_new_ex
wolfSSL Entering wolfSSL_CertManagerNew
wolfSSL Leaving WOLFSSL_CTX_new, return 0
wolfSSL Entering wolfSSL_CTX_use_certificate_chain_file
Getting dynamic buffer
wolfSSL Entering PemToDer
Checking cert signature type
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetSerialNumber
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Key
Not ECDSA cert signature
wolfSSL Entering wolfSSL_CTX_use_PrivateKey_file
Getting dynamic buffer
wolfSSL Entering PemToDer
wolfSSL Entering GetAlgoId
wolfSSL_CTX_load_verify_locations_ex
Getting dynamic buffer
Processing CA PEM file
wolfSSL Entering PemToDer
Adding a CA
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetSerialNumber
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeSubjKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAltNames
    Unsupported name type, skipping
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeExtKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
    Parsed new CA
    Freeing Parsed CA
    Freeing der CA
        OK Freeing der CA
wolfSSL Leaving AddCA, return 0
   Processed a CA
Processed at least one valid CA. Other stuff OK
wolfSSL_CTX_load_verify_locations_ex
Getting dynamic buffer
Processing CA PEM file
wolfSSL Entering PemToDer
Adding a CA
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetSerialNumber
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeSubjKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeExtKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeNsCertType
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
    Parsed new CA
    Freeing Parsed CA
    Freeing der CA
        OK Freeing der CA
wolfSSL Leaving AddCA, return 0
   Processed a CA
Processed at least one valid CA. Other stuff OK
wolfSSL Entering SSL_new
wolfSSL Leaving SSL_new, return 0
wolfSSL Entering SSL_set_fd
wolfSSL Entering SSL_set_read_fd
wolfSSL Leaving SSL_set_read_fd, return 1
wolfSSL Entering SSL_set_write_fd
wolfSSL Leaving SSL_set_write_fd, return 1
wolfSSL Entering SSL_connect()
wolfSSL Entering SendClientHello
Adding signature algorithms extension
growing output buffer
Signature Algorithms extension to write
Point Formats extension to write
Supported Groups extension to write
Encrypt-Then-Mac extension to write
EMS extension to write
Shrinking output buffer
wolfSSL Leaving SendClientHello, return 0
connect state: CLIENT_HELLO_SENT
growing input buffer
received record layer msg
got HANDSHAKE
wolfSSL Entering DoHandShakeMsg()
wolfSSL Entering DoHandShakeMsgType
processing server hello
wolfSSL Entering DoServerHello
Point Formats extension received
Extended Master Secret extension received
wolfSSL Entering VerifyClientSuite
wolfSSL Leaving DoServerHello, return 0
Shrinking input buffer
wolfSSL Leaving DoHandShakeMsgType(), return 0
wolfSSL Leaving DoHandShakeMsg(), return 0
growing input buffer
received record layer msg
got HANDSHAKE
wolfSSL Entering DoHandShakeMsg()
wolfSSL Entering DoHandShakeMsgType
processing certificate
wolfSSL Entering DoCertificate
wolfSSL Entering ProcessPeerCerts
Loading peer's cert chain
    Put another cert into chain
    Put another cert into chain
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetSerialNumber
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeExtKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeSubjKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthInfo
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeCrlDist
wolfSSL Entering GetObjectId()
Certificate Policy extension not supported yet.
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
No CA signer to verify with
Failed to verify CA from chain
wolfSSL error occurred, error = -188
wolfSSL Entering SendAlert
growing output buffer
Shrinking output buffer
wolfSSL Leaving SendAlert, return 0
Verifying Peer's cert
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetSerialNumber
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAltNames
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeExtKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeSubjKeyId
wolfSSL Entering GetObjectId()
Certificate Policy extension not supported yet.
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthInfo
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeCrlDist
wolfSSL Entering GetObjectId()
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
No CA signer to verify with
Failed to verify Peer's cert
    No callback override available, fatal
wolfSSL error occurred, error = -188
wolfSSL Entering SendAlert
wolfSSL Leaving ProcessPeerCerts, return -188
wolfSSL Leaving DoCertificate, return -188
wolfSSL Leaving DoHandShakeMsgType(), return -188
wolfSSL Leaving DoHandShakeMsg(), return -188
wolfSSL error occurred, error = -188
wolfSSL error occurred, error = -188
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -188
wolfSSL Entering SSL_get_error
wolfSSL Leaving SSL_get_error, return -188
wolfSSL Entering ERR_error_string
wolfSSL_connect error -188, ASN no signer error to confirm failure
wolfSSL Entering SSL_free
CTX ref count not 0 yet, no free
Free'ing client ssl
Shrinking input buffer
wolfSSL Entering ClientSessionToSession
wolfSSL Leaving SSL_free, return 0
wolfSSL Entering SSL_CTX_free
CTX ref count down to 0, doing full free
wolfSSL Entering wolfSSL_CertManagerFree
wolfSSL Leaving SSL_CTX_free, return 0
wolfSSL error: wolfSSL_connect failed

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 17:23:07 +0000

Hi,
Please do this and then send over the logs:

./configure --enable-sys-ca-certs --enable-debug
make all
./examples/client/client -h www.wolfssl.com -p 443 --sys-ca-certs

Re: error = -188, ASN no signer error to confirm failure

null@example.com (msorage) — Wed, 08 Mar 2023 17:12:14 +0000

No problem.
which application do you mean?

Thanks very much!
msorage

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 17:09:52 +0000

Hi msorage,
I guess you're going to have to try again with --enable-debug to get some more verbose logging since I can't reproduce your issue here.
Warm regards, anthony

Re: error = -188, ASN no signer error to confirm failure

null@example.com (msorage) — Wed, 08 Mar 2023 16:32:33 +0000

Hi Anthony.
I'm using Ubuntu 20.04

Yeah! I have those certs here too:

$ ls /etc/ssl/certs | wc -l
254

Best regards,
msorage

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 14:06:59 +0000

That's odd. This is my output:

SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SSL curve name is SECP256R1

This is where we are looking for the certificates:

    "/etc/ssl/certs",                   /* Debian, Ubuntu, Gentoo, others */
    "/etc/pki/ca-trust/source/anchors", /* Fedora, RHEL */
    "/etc/pki/tls/certs"                /* Older RHEL */

What distribution of linux are you using? Can you check the locations specified above to see if there are certificates there?

Warm regards, Anthony

Re: error = -188, ASN no signer error to confirm failure

null@example.com (msorage) — Wed, 08 Mar 2023 13:14:51 +0000

./configure --enable-sys-ca-certs; make all; sudo make install

./examples/client/client -h www.wolfssl.com -p 443 --sys-ca-certs  

wolfSSL_connect error -188, ASN no signer error to confirm failure
wolfSSL error: wolfSSL_connect failed

the exact same error here

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 13:10:09 +0000

Hi,
Also, please consider tiny-curl. You can find it at https://www.wolfssl.com/download/

Warm regards, Anthony

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 13:08:42 +0000

On Linux, this worked for me:

./configure --enable-sys-ca-certs  
make all 
./examples/client/client -h www.wolfssl.com -p 443 --sys-ca-certs

Warm regards, Anthony

Re: error = -188, ASN no signer error to confirm failure

null@example.com (msorage) — Wed, 08 Mar 2023 12:57:33 +0000

I'm exploring the wolfssl lib on linux first, so I can try on an embedded system later. So curl won't be a option there
I know there are many differences between embedded bare metal and linux, but I consider this a first step to my goal. The same issue occurred with https client example I got from wolfssl repository.
I don't have any clue why this is happening. With openssl I manage to run the application

Re: error = -188, ASN no signer error to confirm failure

null@example.com (anthony) — Wed, 08 Mar 2023 12:49:25 +0000

Hi,

May I ask why you are doing this and what you are trying to achieve? Is this an academic or hobby project? We love know what people are doing with wolfSSL.

Have you considered using curl? You can download the source for curl and build it with wolfSSL underneath. Then you can look at how curl is calling wolfSSL to get a better understanding of what is needed. Or, depending on your needs, curl might be a better fit.

Warm regards, Anthony