SSL Server socket with micropythen pico

[sishari]

Hello,
Can anybody help me!
I'm trying to create an SSL server socket with following:

context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.load_cert_chain("my.crt", "my.key")

After this line i get allways:
ValueError: invalid key

loop = asyncio.get_event_loop()
loop.create_task(asyncio.start_server(serve, "0.0.0.0", 80,ssl = context))

I dont know what is the problem...

[sophiedegran]

Hi
In micropython certificate have to be in DER format not PEM
have a look to microdot tls example
Hope that help

[sophiedegran]

It should work ... I suggest you to try with microdot directly (many people used it and it works)
After you will have specifiq infos on the old forum (forum.micropython.org)
Tell me..

[mendenm]

Note that the documentation says the data provided isn't the file name, it is the bytes object with the cert. Have you tried context.load_cert_chain(open("cert.der", "rb").read(), open("key.der", "rb").read())?

[sishari]

context.load_cert_chain(open("cert.der", "rb").read(), open("key.der", "rb").read())
Is the same problem... invalid key

I think my cert files are ok. Maybe someone can check my cert files to see if it is correct. (I have changed from *.der to *.txt)
key.txt
cert.txt

[sishari]

Now i have tried microdot but with exact the same problem.
invalid key

[sophiedegran]

Ok so it's a problem of generation of cert..

[sishari]

It should work ... I suggest you to try with microdot directly (many people used it and it works) After you will have specifiq infos on the old forum (forum.micropython.org) Tell me..
I dont know? In the microdot.py is the same code as mine.

[sophiedegran]

Try your cert under microdot ..
I suppose you're under micropython 1.22 STABLE (mini), so install just the tls example in microdot 2.0.3 ... and they dependances

[sishari]

For your info.
I have the v1.22 but it was the same problem.
I think the problem is the key but I have no idea what exactly is the problem.
I hope Carglglz can explain this.....

[Carglglz]

1. openssl req -x509 -newkey rsa:4096 -nodes -out cert.pem -keyout key.pem -days 365
   openssl x509 -in cert.pem -out cert.der -outform DER
   openssl rsa -in key.pem -out key.der -outform DER

@sishari try this instead

$ openssl pkey -in rsa_key.pem -out rsa_key.der -outform DER
$ openssl x509 -in rsa_cert.pem -out rsa_cert.der -outform DER

or even better

Use elliptic curve key/cert pairs:

$ openssl ecparam -name prime256v1 -genkey -noout -out ec_key.der -outform DER
$ openssl req -new -x509 -key ec_key.der -out ec_cert.der -outform DER -days 365 -nodes 

[sishari]

Hello,

You are the best!
With the ec_key it works now!!!
Can you explain to me what is different now?

[sophiedegran]

Nice!

[Carglglz]

@sishari I don't know for sure but I think it is related to this https://en.wikipedia.org/wiki/PKCS i.e. openssl rsa using an old standard and mbedtls (MicroPython SSL backend) not accepting it 🤔, see #8988 (comment)