Topic: Simple SSL connection providing root certs
Hello,
I am following Espressif example projects from GitHub to just open an https:443 connection to any website but I am always getting error -188 "ASN sig error, no CA signer to verify certificate". I am missing something but I don't know what.
I am using this example especifically but also checked some others and all of them look very similar: https://github.com/wolfSSL/wolfssl/tree … ssl_client
As you can see I am trying to connect to google.com and I am providing a bundle of root certificates taken from Mozilla site: https://curl.se/ca/cacert.pem. That's the file you can see in the code below as "mozilla_root_certs_pem"
I've tried to connect to different sites and also providing not that certificate bundle with all root certs but the specific root cert of the site I am connecting to. Always getting the same -188 error.
This is my code:
// file included in CMakeLists.txt
extern const unsigned char mozilla_root_certs_pem_start[] asm("_binary_mozillarootcerts_pem_start");
extern const unsigned char mozilla_root_certs_pem_end[] asm("_binary_mozillarootcerts_pem_end");
WOLFSSL_ESP_TASK tls_smp_client_task_2(void *args)
{
#define TLS_SMP_TARGET_HOST "www.google.com"
#define TLS_SMP_DEFAULT_PORT 443
#if defined(SINGLE_THREADED)
int ret = ESP_OK;
#define TLS_SMP_CLIENT_TASK_RET ret
#else
#define TLS_SMP_CLIENT_TASK_RET
#endif
char buff[256];
const char sndMsg[] = "GET / HTTP/1.1\r\nAccept: */*\r\n";
const char *ch = TLS_SMP_TARGET_HOST; /* see wifi_connect.h */
struct sockaddr_in servAddr;
struct hostent *hp;
struct ip4_addr *ip4_addr;
int ret_i; /* interim return values */
int err; /* interim return values */
int sockfd;
int doPeerCheck;
int sendGet;
#ifdef DEBUG_WOLFSSL
int this_heap = 0;
#endif
#ifndef NO_DH
int minDhKeyBits = DEFAULT_MIN_DHKEY_BITS;
#endif
/* declare wolfSSL objects */
WOLFSSL_CTX *ctx;
WOLFSSL *ssl;
size_t len;
WOLFSSL_ENTER(TLS_SMP_CLIENT_TASK_NAME);
doPeerCheck = 1;
sendGet = 1;
#ifdef DEBUG_WOLFSSL
WOLFSSL_MSG("Debug ON");
ShowCiphers(NULL);
#endif
/* Initialize wolfSSL */
wolfSSL_Init();
/* Create a socket that uses an Internet IPv4 address,
* Sets the socket to be stream based (TCP),
* 0 means choose the default protocol. */
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1)
{
ESP_LOGE(TAG, "ERROR: failed to create the socket\n");
}
ESP_LOGI(TAG, "get target IP address");
hp = gethostbyname(TLS_SMP_TARGET_HOST);
if (!hp)
{
ESP_LOGE(TAG, "Failed to get host name.");
ip4_addr = NULL;
}
else
{
ip4_addr = (struct ip4_addr *)hp->h_addr;
ESP_LOGI(TAG, "Host name: %s", hp->h_name);
}
/* Create and initialize WOLFSSL_CTX */
ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()); /* SSL 3.0 - TLS 1.3. */
/* options: */
/* ctx = wolfSSL_CTX_new(wolfSSLv1_2_client_method()); only TLS 1.2 */
/* ctx = wolfSSL_CTX_new(wolfSSLv1_3_client_method()); only TLS 1.3 */
/* wolfSSL_CTX_NoTicketTLSv12(); */
/* wolfSSL_NoTicketTLSv12(); */
if (ctx == NULL)
{
ESP_LOGE(TAG, "ERROR: failed to create WOLFSSL_CTX\n");
}
// load certs
ret_i = wolfSSL_CTX_load_verify_buffer(ctx,
mozilla_root_certs_pem_start,
mozilla_root_certs_pem_end - mozilla_root_certs_pem_start,
WOLFSSL_FILETYPE_PEM);
if (ret_i != WOLFSSL_SUCCESS)
{
ESP_LOGE(TAG, "ERROR: failed to load CA cert %d, "
"please check the file.\n",
ret_i);
}
{
ESP_LOGI(TAG, "CA cert loaded successfully");
}
/* Initialize the server address struct with zeros */
memset(&servAddr, 0, sizeof(servAddr));
/* Fill in the server address */
servAddr.sin_family = AF_INET; /* using IPv4 */
servAddr.sin_port = htons(TLS_SMP_DEFAULT_PORT); /* on DEFAULT_PORT */
if (*ch >= '1' && *ch <= '9')
{
/* Get the server IPv4 address from the command line call */
WOLFSSL_MSG("inet_pton");
if ((ret_i = inet_pton(AF_INET,
TLS_SMP_TARGET_HOST,
&servAddr.sin_addr)) != 1)
{
ESP_LOGE(TAG, "ERROR: invalid address ret=%d\n", ret_i);
}
ESP_LOGI(TAG, "Using IP address: %s", TLS_SMP_TARGET_HOST);
}
else
{
servAddr.sin_addr.s_addr = ip4_addr->addr;
ESP_LOGI(TAG, "Using host name: %s", TLS_SMP_TARGET_HOST);
}
/* Connect to the server */
sprintf(buff,
"Connecting to server....%s (port:%d)",
TLS_SMP_TARGET_HOST,
TLS_SMP_DEFAULT_PORT);
ESP_LOGI(TAG, "%s\n", buff);
if ((ret_i = connect(sockfd,
(struct sockaddr *)&servAddr,
sizeof(servAddr))) == -1)
{
ESP_LOGE(TAG, "ERROR: failed to connect ret=%d\n", ret_i);
}
WOLFSSL_MSG("Create a WOLFSSL object");
/* Create a WOLFSSL object */
if ((ssl = wolfSSL_new(ctx)) == NULL)
{
ESP_LOGE(TAG, "ERROR: failed to create WOLFSSL object\n");
}
else
{
ESP_LOGI(TAG, "WOLFSSL object created successfully");
}
/* Attach wolfSSL to the socket */
ret_i = wolfSSL_set_fd(ssl, sockfd);
if (ret_i == WOLFSSL_SUCCESS)
{
ESP_LOGI(TAG, "wolfSSL_set_fd success");
}
else
{
ESP_LOGE(TAG, "ERROR: failed wolfSSL_set_fd. Error: %d\n", ret_i);
}
ESP_LOGI(TAG, "Connect to wolfSSL server...");
ret_i = wolfSSL_connect(ssl);
if (ret_i == WOLFSSL_SUCCESS)
{
ESP_LOGI(TAG, "Connect success! Sending message...");
/* Get a message for the server from stdin */
WOLFSSL_MSG("Message for server: ");
memset(buff, 0, sizeof(buff));
len = XSTRLEN(sndMsg);
strncpy(buff, sndMsg, len);
buff[len] = '\0';
ESP_LOGI(TAG, "SSL connect ok, sending message:\n\n%s\n", buff);
/* Send the message to the server */
do
{
err = 0; /* reset error */
ret_i = wolfSSL_write(ssl, buff, len);
if (ret_i <= 0)
{
err = wolfSSL_get_error(ssl, 0);
}
} while (err == WOLFSSL_ERROR_WANT_WRITE ||
err == WOLFSSL_ERROR_WANT_READ);
if (ret_i != len)
{
ESP_LOGE(TAG, "ERROR: failed to write\n");
}
else
{
ESP_LOGI(TAG, "Message sent! Awaiting response...");
}
/* Read the server data into our buff array */
memset(buff, 0, sizeof(buff));
do
{
err = 0; /* reset error */
ret_i = wolfSSL_read(ssl, buff, sizeof(buff));
if (ret_i <= 0)
{
err = wolfSSL_get_error(ssl, 0);
}
} while ((err == WOLFSSL_ERROR_WANT_READ) ||
(err == WOLFSSL_ERROR_WANT_WRITE));
if (ret_i < 0)
{
ESP_LOGE(TAG, "ERROR: failed to read\n");
}
/* Show any data the server sends */
ESP_LOGI(TAG, "Server response: \n\n%s\n", buff);
ret_i = wolfSSL_shutdown(ssl);
while (ret_i == WOLFSSL_SHUTDOWN_NOT_DONE)
{
ret_i = wolfSSL_shutdown(ssl); /* bidirectional shutdown */
if (ret_i == WOLFSSL_SUCCESS)
{
ESP_LOGI(TAG, "Bidirectional shutdown complete\n");
break;
}
else if (ret_i != WOLFSSL_SHUTDOWN_NOT_DONE)
{
ESP_LOGE(TAG, "Bidirectional shutdown failed\n");
break;
}
}
if (ret_i != WOLFSSL_SUCCESS)
{
ESP_LOGE(TAG, "Bidirectional shutdown failed\n");
}
} /* wolfSSL_connect(ssl) == WOLFSSL_SUCCESS) */
else
{
ESP_LOGE(TAG, "ERROR: failed to connect to wolfSSL. "
"Error: %d\n",
ret_i);
int err = wolfSSL_get_error(ssl, 0);
ESP_LOGE(TAG, "wolfSSL_get_error: %d\n",
err);
}
ESP_LOGI(TAG, "Cleanup and exit");
wolfSSL_free(ssl); /* Release the wolfSSL object memory */
wolfSSL_CTX_free(ctx); /* Free the wolfSSL context object */
wolfSSL_Cleanup(); /* Cleanup the wolfSSL environment */
close(sockfd); /* Close the connection to the server */
vTaskDelete(NULL);
return TLS_SMP_CLIENT_TASK_RET;
}And this is the output:
I (3887) wifi:dp: 1, bi: 102400, li: 3, scale listen interval from 307200 us to 307200 us
I (3905) wifi:<ba-add>idx:0 (ifx:0, 12:a7:b9:4e:84:5e), tid:4, ssn:0, winSize:64
I (3922) wifi:AP's beacon interval = 102400 us, DTIM period = 1
I (4915) esp_netif_handlers: example_netif_sta ip: 172.28.5.245, mask: 255.255.255.0, gw: 172.28.5.1
I (4916) example_connect: Got IPv4 event: Interface "example_netif_sta" address: 172.28.5.245
I (5112) example_connect: Got IPv6 event: Interface "example_netif_sta" address: fe80:0000:0000:0000:96e6:86ff:fe92:d4e4, type: ESP_IP6_ADDR_IS_LINK_LOCAL
I (5115) example_common: Connected to example_netif_sta
I (5120) example_common: - IPv4 address: 172.28.5.245,
I (5125) example_common: - IPv6 address: fe80:0000:0000:0000:96e6:86ff:fe92:d4e4, type: ESP_IP6_ADDR_IS_LINK_LOCAL
I (5636) time_helper: The current date/time is: Fri Jun 6 15:43:24 2025
I (6636) time_helper: Waiting for NTP to sync time... (1/10)
I (6637) time_helper: The current date/time is: Fri Jun 6 15:43:25 2025
I (7637) time_helper: Waiting for NTP to sync time... (2/10)
I (7638) time_helper: The current date/time is: Fri Jun 6 15:43:26 2025
I (8536) wifi:<ba-add>idx:1 (ifx:0, 12:a7:b9:4e:84:5e), tid:0, ssn:0, winSize:64
I (8589) time_helper: Waiting for NTP to sync time... (3/10)
I (8590) time_helper: The current date/time is: Wed Jun 18 03:52:51 2025
I (8591) time_helper: Successfully set time via NTP servers.
I (8596) main: Initial Stack Used (before wolfSSL Server): 2240 bytes
I (8602) main: Starting TLS Client task ...I (8606) main: main tls_smp_client_init heap @ 0x3ffbac24 = 236616
I (8612) client-tls: get target IP address
I (8637) client-tls: Host name: google.com
I (9031) client-tls: CA cert loaded successfully
I (9032) client-tls: Using host name: google.com
I (9032) client-tls: Connecting to server....www.google.com (port:443)I (9063) client-tls: WOLFSSL object created successfully
I (9064) client-tls: wolfSSL_set_fd success
I (9064) client-tls: Connect to wolfSSL server...
E (9557) client-tls: ERROR: failed to connect to wolfSSL. Error: -1E (9558) client-tls: wolfSSL_get_error: -188
I (9558) client-tls: Cleanup and exit
If I remove the peer verification by adding the next line before the connection:
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, 0);Then at least connects, just confirming it's a problem with cert verification:
I (7610) client-tls: Using host name: google.com
I (7610) client-tls: Connecting to server....www.google.com (port:443)I (7641) client-tls: WOLFSSL object created successfully
I (7641) client-tls: WOLFSSL object created successfully
I (7641) client-tls: WOLFSSL object created successfully
I (7642) client-tls: wolfSSL_set_fd success
I (7642) client-tls: wolfSSL_set_fd success
I (7642) client-tls: Connect to wolfSSL server...
I (8236) client-tls: Connect success! Sending message...
I (8237) client-tls: SSL connect ok, sending message:GET / HTTP/1.1
Accept: */*I (8240) client-tls: Message sent! Awaiting response...
What am I missing here? How to load root certs to properly validate the chain received from websites?
Thank you.
We'll be having a release in the near future, so if you'd like anything specific to be included, please let me know right away and/or send a message to support [at] wolfssl.com