Hi toni992,

My name is Anthony and I am a member of the wolfSSL team. The short answer is that it happens during the TLS  handshake.

The longer more nuanced answer follows.  From RFC 8466 (TLS 1.3)  https://datatracker.ietf.org/doc/html/rfc8446#section-2 you can see the following:

       Client                                           Server

Key  ^ ClientHello
Exch | + key_share*
     | + signature_algorithms*
     | + psk_key_exchange_modes*
     v + pre_shared_key*       -------->
                                                  ServerHello  ^ Key
                                                 + key_share*  | Exch
                                            + pre_shared_key*  v
                                        {EncryptedExtensions}  ^  Server
                                        {CertificateRequest*}  v  Params
                                               {Certificate*}  ^
                                         {CertificateVerify*}  | Auth
                                                   {Finished}  v
                               <--------  [Application Data*]
     ^ {Certificate*}
Auth | {CertificateVerify*}
     v {Finished}              -------->
       [Application Data]      <------->  [Application Data]

The certificate and certificate verify messages are where it happens.

The Certificate message is where the certificate chain is sent to the peer.  The CertificateVerify message is where the signature of the TLS handshake transcript is sent.  The peer verifies the chain and the signature of the TLS handshake transcript.

Please let me know if you would like further clarifications.

This is a great question and here at wolfSSL we love to know about the community member and what they are doing. 

Can you please let us know about your interest in wolfSSL and protocols?  Can you let us know about yourself and your projects?

For example, where are you located?  Can you let us know your goals.

Warm regards, Anthony

HI jlewis,

My name is Anthony and I am a member of the wolfSSL team.

I noticed that the issuer and subject are the same making this a Root CA certificate.  I think you might need a basic constraints extension that states that this is a CA certificate. 

Warm regards, Anthony

Hi ,
My name is Anthony and I am a member of the wolfSSL team.  I'll be helping you on this topic.  Please stay tuned as I will need to ask my wider engineering team.

Warm regards, Anthony

Hi db,

My name is Anthony and I am a member of the wolfSSL team. From what I understand, sigpipe means  the peer closed the socket when there was data still available to read.  This is generally resolved by, on both sides, doing a shutdown (for example, calling wolfSSL_shutdown() ) , checking for WOLFSSL_SHUTDOWN_NOT_DONE, and then doing wolfSSL_shutdown() again.  You can search for WOLFSSL_SHUTDOWN_NOT_DONE in wolfssl/examples/server/server.c and wolfssl/examples/client/client.c to see what I mean.

Warm regards, Anthony

Hi bganjl,

You are correct, we do not have support for that. Can you please email support@wolfssl.com so we can get started on a feature request?  Please reference this forum post when you send the message.

Warm regards, Anthony

Hi Scott,

Thanks for all the information you provided. Since you have commercial support, please open a support ticket by sending a message to support@wolfssl.com using an email account associated with your organization.  In that message, please reference this forum posting.  We look forward to helping you there.

Warm regards, Anthony

Hi MMI_101,

Thanks for using wolfSSL and reaching out to us here on the forums.

In order to be able to use wc_InitCert, you must have the macro WOLFSSL_CERT_GEN defined. I don't know what macros you have defined in your user_settings.h and/or compiler flags, but my best guess is that this is not defined.  If it is defined, please let me know what other macros are defined.

Here at wolfSSL we love knowing how our code is being used.  Can you tell us a bit about yourself and your project?

- Where are you located?  Country and nearest large urban area should suffice.
- It this project out of personal interest, an academic project or commercial in nature?
- Is there an institution or company associated with your work?

Any other details about yourself and your project would be greatly appreciated.

Warm regards, Anthony

Hi,

I'm sorry for the delayed response. I had lost track of this as I thought I had answered your questions.

dP and dQ will have to be calculated by you.  That said, they are only used in the Chinese Remainder Theorem (CRT).  If you define `RSA_LOW_MEM`, that is using a non-CRT implementation then you won't need to worry about dP and dQ.  That said, execution time will increase. 

Let me know if this helps.

Warm regards, Anthony

Hi Adrian,

My name is Anthony and I am a member of the wolfSSL team.

We do have the function wc_RsaExportKey() which looks like this:

WOLFSSL_API int wc_RsaExportKey(RsaKey* key,
                                byte* e, word32* eSz,
                                byte* n, word32* nSz,
                                byte* d, word32* dSz,
                                byte* p, word32* pSz,
                                byte* q, word32* qSz);

But I don't think we have the corresponding API for importing it in this format.  That said, would you like to register this as a feature request?

If so, please send an email to support@wolfssl.com.  The process will only take a couple of minutes of your time.  Please also reference this forum post in that email message.

Warm regards, Anthony

Good to know!  Glad you got it resolved.  Can you let us know a bit about yourself?
Where are you located?
What are your goals?
Is the nature of this project academic, commercial, or personal?
We love knowing how our code is being used and any information you are willing to share helps us to better understand our user base.

Warm regards, Anthony

Hi chenkanghao001,

Here is a relevant piece of code that shows up in your debug message:

        if (CipherRequires(first, second, REQUIRES_RSA)) {
            WOLFSSL_MSG("Requires RSA");
            if (ssl->options.haveRSA == 0) {
                WOLFSSL_MSG("Don't have RSA");
                return 0;
            }
        }

Can I ask you how you configure and build wolfssl? Can you let us know what configuration flags you use? 

Also, can you give us some hints as to how you initialize your server and client?

I ask these things because perhaps you are disabling RSA somehow.

Warm regards, Anthony

Hi Will,

A simpler solution might be to use ECC certs.  Have you investigated that possibility?

Warm regards, Anthony