Regards

1.  Define FP_MAX_BITS to 8192 (since two of the certs in the chain use 4096-bit keys)
2.  Compile CyaSSL/wolfSSL with SHA-512 enabled (--enable-sha512).  This enables SHA-384 as well.  One of the chain certificates uses SHA-384 w/ RSA as a Signature Algorithm.

Can you try #2 above and see if it fixes your issue?

Thanks,
Chris

It's interesting that you aren't able to connect to https://www.jctixx.de, using the attached certificate above.

On my development machine (OSX), I was able to compile cURL and wolfSSL and connect to the server above using the addtrustexternalcaroot.crt certificate.  I was using:

wolfSSL (current GitHub HEAD: https://github.com/wolfssl/wolfssl)
cURL (curl 7.39.0)

curl --cacert ~/Downloads/addtrustexternalcaroot.crt https://www.jctixx.de

I noticed that several certificates in that server's cert chain used 4096-bit RSA keys.  Do you know what settings have been used to compile wolfSSL/CyaSSL?  If wolfSSL has been compiled to use the fastmath library (USE_FAST_MATH), FP_MAX_BITS in ./wolfssl/wolfcrypt/tfm.h will need to be set to 8192 to accommodate 4096-bit RSA keys.  You can either change this in tfm.h, or add it to the preprocessor flags when compiling wolfSSL.

Thanks,
Chris

"curl 7.38.0 (mipsel-openwrt-linux-gnu) libcurl/7.38.0 CyaSSL/3.2.0
Protocols: http https
Features: Largefile SSL "

However, I did also try with the trunk Version, I think it was version 3.6.0 - and it did not work with curl, only if curl was built with OpenSSL or gnutls. I would still like to use wolfSSL/CyaSSL, as I see it is more efficient.

I was able to connect to https://ww.jctixx.de using the wolfSSL example client, using the attached CA certificate.

$ cd wolfssl-3.6.6
$ ./configure
$ make
$ ./examples/client/client -h www.jctixx.de -p 443 -A addtrustexternalcaroot.crt -g

Is this the same CA root that you are using when connecting to that site?

Best Regards,
Chris

curl --cacert /etc/ssl/certs/Equifax_Secure_CA.crt https://www.google.de

Otherwise, I get the usual error about CA signer not available for verification.

The Website I try to curl, https://www.jctixx.de does use Comodo Positive SSL, which does use the AddTrust External CA Root Certificate. I have that one in my cert space as well, and tried to curl jctixx.de the same way, however, it does not give back anything else than curl: (77) CA signer not available for verification error.

Any ideas how to solve that?

Thanks a lot!

As for 4096-bit RSA certificates, since I'm assuming you are using fast math, you need to "#define FP_MAX_BITS 8192" in wolfSSL. By default, the max bits setting is good for doing 2048-bit RSA keys.

I tried to use multiple SSL Solutions with curl and found CyaSSL / wolfSSL and tried that one:
Infact, it is one of the only SSL engines "really working" on OpenWRT 14.07 without needing about 20 seconds on an older router to curl one https site - so kudos for that !

I am using OpenWRT 14.07, compiled by myself, for an WGT634U (Legacy Branch).
I left most settings on default, only changed CyaSSL to default SSL Engine, as well as I choose it in curl.
After installing on the router, I also installed ca-certificates.

I can access an site like google - but only with the use of the insecure switch -k.
Other than that, I get an curl: (77) CA signer not available for verification error.

The Website I try to access via curl does also use 4096 Bit Certificates, and I thought there was some problem with that size. Is there any possiblity to get that error fixed in the stable OpenWRT branch, or can I change something myself in the package to get myself up and running without --insecure?

Thanks a lot!

curl -v:
curl 7.38.0 (mipsel-openwrt-linux-gnu) libcurl/7.38.0 CyaSSL/3.2.0
Protocols: http https
Features: Largefile SSL