https using certificates - working towards AWS S3 access

[johnofleek]

Hi
I'm trying to understand the api for https. I'm not sure where to look for

• documentation / api's
• examples
• how to enable debugging of https and lower level

Does the following code look ok? - it works if use https.setInsecure(); Doesn't work if I add a cert

void test_https(void){
  HTTPClient https;

  // https.setInsecure();  // Use certs, but do not check their authenticity

  // find current time now
  struct timeval tv_now;
  gettimeofday(&tv_now, NULL);
  time_t currentTime = tv_now.tv_sec;
  https.setX509Time(currentTime);

  //https.setCACert(rootCACertificate2);

  BearSSL::X509List cert(rootCACertificate2);
  https.setTrustAnchors(&cert);

  if (https.begin(TARGET_URL_1)) {
      int32_t httpCode = https.GET();
      DEBUG_INFO("httpCode %ld ",httpCode );
      if (httpCode > 0) {
          String httpGetPayload = https.getString();
          const char *payload = httpGetPayload.c_str();
          DEBUG_INFO("httpGetPayload %d ", strlen(payload) );
      }
      else{
        DEBUG_INFO("GET BAD");
      }
  }
  https.end();
}

[earlephilhower]

Take a look at the verification example https://github.com/earlephilhower/arduino-pico/tree/master/libraries/WiFi/examples/BearSSL_Validation . It goes over pretty much all the options available to you.

For debugging, it looks like I skipped porting that bit from the ESP8266. I think if you change

arduino-pico/libraries/WiFi/src/WiFiClientSecureBearSSL.cpp

Lines 58 to 62 in 3778fbb

	#if defined(DEBUG_ESP_SSL) && defined(DEBUG_ESP_PORT)
	#define DEBUG_BSSL(fmt, ...) DEBUG_ESP_PORT.printf_P((PGM_P)PSTR( "BSSL:" fmt), ## __VA_ARGS__)
	#else
	#define DEBUG_BSSL(...)
	#endif

to

#define DEBUG_BSSL(fmt, ...)  Serial.printf("BSSL:" fmt, ## __VA_ARGS__)

(i.e. remove any conditional and update to hardcode the output port) you will get the full debugging dumps.

[johnofleek]

Many thanks - I should have thought of looking at the examples - sorry

Actually just noticed
https://github.com/esp8266/Arduino/blob/master/libraries/ESP8266WiFi/examples/HTTPSRequest/HTTPSRequest.ino

I'll try that - I expect my problem is I'm using the wrong certs

I think my code works but my understanding of https is lacking - if I use an amazon cert against an amazon test site (path is same as URL) the GET works.

[earlephilhower]

99% of the time it's the certificate. Using OpenSSL you can dump the CAs from the AWS systems (or maybe they already provide this somewhere officially?). If there are possibly >1 root CA for AWS you'll need to use CertStore (which also has examples)...

Good luck!