Skip to content

Commit 75a4312

Browse files
dgarskedgarske
authored
Merge pull request #527 from mattia-moffa/20250923-certauth-clienthello
TLS 1.3 certificate_authorities extension in ClientHello
2 parents 015bf65 + 72a39e2 commit 75a4312

File tree

4 files changed

+596
-0
lines changed

4 files changed

+596
-0
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,8 @@ android/wolfssljni-ndk-sample/proguard-project.txt
115115
/tls/server-tls-uart
116116
/tls/server-tls-verifycallback
117117
/tls/server-tls-writedup
118+
/tls/client-tls13-certauth-clienthello
119+
/tls/server-tls13-certauth-clienthello
118120
/tls/client-ech
119121
/tls/client-ech-local
120122
/tls/server-ech-local

‎tls/README.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1413,6 +1413,35 @@ Execute them like so:
14131413
./server-tls-posthsauth 127.0.0.1
14141414
```
14151415

1416+
## TLS Example with certificate_authorities extension in ClientHello message
1417+
1418+
See `client-tls13-certauth-clienthello.c` and `server-tls13-certauth-clienthello.c`. These applications show how to use the TLS 1.3 [certificate_authorities](https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.4) extension to let the client send the names of its supported certificate authorities inside the ClientHello message, so that the server can perform certificate selection based on them. This can be useful in scenarios where the server has multiple certificates issued by separate CAs.
1419+
1420+
To use this example, you must enable full OpenSSL compatibility. Build and install wolfSSL like so:
1421+
1422+
```
1423+
$ ./autogen.sh
1424+
$ ./configure --enable-opensslall
1425+
$ make
1426+
$ sudo make install
1427+
```
1428+
1429+
Then build the examples as follows:
1430+
1431+
```
1432+
make client-tls13-certauth-clienthello server-tls13-certauth-clienthello
1433+
```
1434+
1435+
Execute them like so:
1436+
1437+
```
1438+
./server-tls13-certauth-clienthello
1439+
```
1440+
1441+
```
1442+
./client-tls13-certauth-clienthello 127.0.0.1
1443+
```
1444+
14161445
## Support
14171446

14181447
Please contact wolfSSL at [email protected] with any questions, bug fixes,

‎tls/client-tls13-certauth-clienthello.c‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
/* client-tls13-certauth-clienthello.c
2+
*
3+
* Copyright (C) 2006-2025 wolfSSL Inc.
4+
*
5+
* This file is part of wolfSSL. (formerly known as CyaSSL)
6+
*
7+
* wolfSSL is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 2 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfSSL is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
20+
*/
21+
22+
/* This example showcases the usage of the TLS 1.3 certificate_authorities
23+
* extension in the ClientHello message, to indicate to the server which
24+
* certificate authorities the client supports, guiding certificate selection.
25+
*
26+
* Example wolfSSL config for this example: ./configure --enable-opensslall
27+
*/
28+
29+
/* the usual suspects */
30+
#include <stdlib.h>
31+
#include <stdio.h>
32+
#include <string.h>
33+
34+
/* socket includes */
35+
#include <sys/socket.h>
36+
#include <arpa/inet.h>
37+
#include <netinet/in.h>
38+
#include <unistd.h>
39+
40+
/* wolfSSL */
41+
#ifndef WOLFSSL_USER_SETTINGS
42+
#include <wolfssl/options.h>
43+
#endif
44+
#include <wolfssl/ssl.h>
45+
#include <wolfssl/wolfio.h>
46+
#include <wolfssl/wolfcrypt/error-crypt.h>
47+
48+
#define DEFAULT_PORT 11111
49+
50+
#define CERT_FILE "../certs/client-cert.pem"
51+
#define KEY_FILE "../certs/client-key.pem"
52+
#define CA_FILE "../certs/ca-cert.pem"
53+
54+
int main(int argc, char** argv)
55+
{
56+
int ret = 0;
57+
#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \
58+
!defined(WOLFSSL_NO_CA_NAMES) && !defined(NO_CERTS) && \
59+
defined(WOLFSSL_TLS13) && (defined(OPENSSL_EXTRA) || \
60+
defined(OPENSSL_EXTRA_X509_SMALL)) && (defined(OPENSSL_ALL) || \
61+
defined(WOLFSSL_NGINX) || defined(HAVE_LIGHTY))
62+
63+
int sockfd = SOCKET_INVALID;
64+
struct sockaddr_in servAddr;
65+
char buff[256];
66+
size_t len;
67+
68+
/* declare wolfSSL objects */
69+
WOLFSSL_CTX* ctx = NULL;
70+
WOLFSSL* ssl = NULL;
71+
72+
/* Declare CA name object */
73+
WOLF_STACK_OF(WOLFSSL_X509_NAME)* caName = NULL;
74+
75+
/* Check for proper calling convention */
76+
if (argc != 2) {
77+
printf("usage: %s <IPv4 address>\n", argv[0]);
78+
return 0;
79+
}
80+
81+
/* Create a socket that uses an internet IPv4 address,
82+
* Sets the socket to be stream based (TCP),
83+
* 0 means choose the default protocol. */
84+
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
85+
fprintf(stderr, "ERROR: failed to create the socket\n");
86+
ret = -1; goto exit;
87+
}
88+
89+
/* Initialize the server address struct with zeros */
90+
memset(&servAddr, 0, sizeof(servAddr));
91+
92+
/* Fill in the server address */
93+
servAddr.sin_family = AF_INET; /* using IPv4 */
94+
servAddr.sin_port = htons(DEFAULT_PORT); /* on DEFAULT_PORT */
95+
96+
/* Get the server IPv4 address from the command line call */
97+
if (inet_pton(AF_INET, argv[1], &servAddr.sin_addr) != 1) {
98+
fprintf(stderr, "ERROR: invalid address\n");
99+
ret = -1; goto exit;
100+
}
101+
102+
/* Connect to the server */
103+
if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr)))
104+
== -1) {
105+
fprintf(stderr, "ERROR: failed to connect\n");
106+
goto exit;
107+
}
108+
109+
/*---------------------------------*/
110+
/* Start of wolfSSL initialization and configuration */
111+
/*---------------------------------*/
112+
113+
/* Initialize wolfSSL */
114+
if ((ret = wolfSSL_Init()) != WOLFSSL_SUCCESS) {
115+
fprintf(stderr, "ERROR: Failed to initialize the library\n");
116+
goto exit;
117+
}
118+
119+
/* Create and initialize WOLFSSL_CTX */
120+
if ((ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method())) == NULL) {
121+
fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n");
122+
ret = -1; goto exit;
123+
}
124+
125+
/* Load client certificate into WOLFSSL_CTX */
126+
if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM))
127+
!= WOLFSSL_SUCCESS) {
128+
fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
129+
CERT_FILE);
130+
goto exit;
131+
}
132+
133+
/* Load client key into WOLFSSL_CTX */
134+
if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM))
135+
!= WOLFSSL_SUCCESS) {
136+
fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
137+
KEY_FILE);
138+
goto exit;
139+
}
140+
141+
/* Load CA certificate into WOLFSSL_CTX */
142+
if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL))
143+
!= WOLFSSL_SUCCESS) {
144+
fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
145+
CA_FILE);
146+
goto exit;
147+
}
148+
149+
/* Load the CA certificate name to send in certificate_authorities extension
150+
*/
151+
if ((caName = wolfSSL_load_client_CA_file(CA_FILE)) == NULL) {
152+
fprintf(stderr, "ERROR: failed to load CA name from %s, please check "
153+
"the file.\n", CA_FILE);
154+
goto exit;
155+
}
156+
157+
/* Set CA name to send in certificate_authorities extension */
158+
wolfSSL_CTX_set0_CA_list(ctx, caName);
159+
160+
/* Create a WOLFSSL object */
161+
if ((ssl = wolfSSL_new(ctx)) == NULL) {
162+
fprintf(stderr, "ERROR: failed to create WOLFSSL object\n");
163+
ret = -1; goto exit;
164+
}
165+
166+
/* Attach wolfSSL to the socket */
167+
if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) {
168+
fprintf(stderr, "ERROR: Failed to set the file descriptor\n");
169+
goto exit;
170+
}
171+
172+
/* Connect to wolfSSL on the server side */
173+
if ((ret = wolfSSL_connect(ssl)) != WOLFSSL_SUCCESS) {
174+
fprintf(stderr, "ERROR: failed to connect to wolfSSL\n");
175+
goto exit;
176+
}
177+
178+
/* Get a message for the server from stdin */
179+
printf("Message for server: ");
180+
memset(buff, 0, sizeof(buff));
181+
if (fgets(buff, sizeof(buff), stdin) == NULL) {
182+
fprintf(stderr, "ERROR: failed to get message for server\n");
183+
ret = -1; goto exit;
184+
}
185+
len = strnlen(buff, sizeof(buff));
186+
187+
/* Send the message to the server */
188+
if ((ret = wolfSSL_write(ssl, buff, len)) != len) {
189+
fprintf(stderr, "ERROR: failed to write entire message\n");
190+
fprintf(stderr, "%d bytes of %d bytes were sent", ret, (int) len);
191+
goto exit;
192+
}
193+
194+
/* Read the server data into our buff array */
195+
memset(buff, 0, sizeof(buff));
196+
if ((ret = wolfSSL_read(ssl, buff, sizeof(buff)-1)) < 0) {
197+
fprintf(stderr, "ERROR: failed to read\n");
198+
goto exit;
199+
}
200+
201+
/* Print to stdout any data the server sends */
202+
printf("Server: %s\n", buff);
203+
204+
/* Return reporting a success */
205+
ret = 0;
206+
207+
exit:
208+
/* Cleanup and return */
209+
if (sockfd != SOCKET_INVALID)
210+
close(sockfd); /* Close the connection to the server */
211+
if (ssl)
212+
wolfSSL_free(ssl); /* Free the wolfSSL object */
213+
if (ctx)
214+
wolfSSL_CTX_free(ctx); /* Free the wolfSSL context object */
215+
wolfSSL_Cleanup(); /* Cleanup the wolfSSL environment */
216+
#else
217+
printf("Example requires specific wolfSSL features\n");
218+
#endif
219+
(void)argc;
220+
(void)argv;
221+
222+
return ret;
223+
}

0 commit comments

Comments
 (0)