Generate Test ECC CA + Cert Leaf File: server-ecc-cert.pem

[gojimmypi]

Description

Adds a new ./certs/server-ecc-cert.pem file containing both:

• Server ECC cert leaf: ./certs/server-ecc.pem
• ECC CA cert: ./certs/ca-ecc-cert.pem

In particular, adds a new static const unsigned char server_ecc_cert[] to wolfssl/certs_test.h allowing an embedded server to easily have access to leaf + CA.

See also new certs:

• Add SM Cipher certificate test header: certs_test_sm.h #6825
• Generate server-sm2-cert.der #9218

Fixes zd# n/a

Testing

How did you test?

Manually tested with my WIP Embedded ESP32 Server and this TLS 1.3 command-line client:

./examples/client/client -h 192.168.1.107 -p 11111 -v 4 -A ./certs/ca-ecc-cert.pem -c ./certs/client-ecc-cert.pem -k ./certs/ecc-client-key.pem
Alternate cert chain used
 issuer : /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected]
 subject: /C=US/ST=Washington/L=Seattle/O=Elliptic/OU=ECC/CN=www.wolfssl.com/[email protected]
 serial number:03
SSL version is TLSv1.3
SSL cipher suite is TLS13-AES128-GCM-SHA256
SSL signature algorithm is SHA256
SSL curve name is SECP256R1
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICojCCAkigAwIBAgIBAzAKBggqhkjOPQQDAjCBlzELMAkGA1UEBhMCVVMxEzAR
BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dv
bGZTU0wxFDASBgNVBAsMC0RldmVsb3BtZW50MRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQxMjE4
MjEyNTMwWhcNMjcwOTE0MjEyNTMwWjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxETAPBgNVBAoMCEVsbGlwdGlj
MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS
IX/wzxjakRECNIboIFgzC4A0idijgYkwgYYwHQYDVR0OBBYEFF1dJu+sfjb5m3YV
K0olAiPvsokwMB8GA1UdIwQYMBaAFFaOmsPwQt4YuUVVbvmTz+rD86UhMAwGA1Ud
EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBEG
CWCGSAGG+EIBAQQEAwIGQDAKBggqhkjOPQQDAgNIADBFAiEAi4Kl0vbKhLqtLd42
6SpN7ksgRrqrTtAQbuswtn7Yr4wCIAZ0QGqpMVT+IJ3GbSvfHapj2vyXUIeSae5j
V7bs4un6
-----END CERTIFICATE-----
Session timeout set to 500 seconds
Client Random : A2C361D0EAE0766E6321B6C609DB0C3EC749EDA316FF75599344A4490665493A
SSL-Session:
    Protocol  : unknown
    Cipher    : NONE
    Session-ID:
    Session-ID-ctx:
    Master-Key: 7707D730DE65861906707C8C14AF1C7E50C6A0093D1199E603C62A121FCF988D00000000000000000000000000000000
    TLS session ticket: NONE
    Start Time: 0
    Timeout   : 0 (sec)
    Extended master secret: no
I hear you fa shizzle!

And TLS 1.2

gojimmypi@raspberrypi:~/workspace/wolfssl $ ./examples/client/client -h 192.168.1.107 -p 11111 -v 3   -A ./certs/ca-ecc-cert.pem  -c ./certs/client-ecc-cert.pem  -k ./certs/ecc-client-key.pem
Alternate cert chain used
 issuer : /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/[email protected]
 subject: /C=US/ST=Washington/L=Seattle/O=Elliptic/OU=ECC/CN=www.wolfssl.com/[email protected]
 serial number:03
SSL version is TLSv1.2
SSL cipher suite is ECDHE-ECDSA-AES128-GCM-SHA256
SSL signature algorithm is SHA256
SSL curve name is SECP256R1
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICojCCAkigAwIBAgIBAzAKBggqhkjOPQQDAjCBlzELMAkGA1UEBhMCVVMxEzAR
BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dv
bGZTU0wxFDASBgNVBAsMC0RldmVsb3BtZW50MRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQxMjE4
MjEyNTMwWhcNMjcwOTE0MjEyNTMwWjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxETAPBgNVBAoMCEVsbGlwdGlj
MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS
IX/wzxjakRECNIboIFgzC4A0idijgYkwgYYwHQYDVR0OBBYEFF1dJu+sfjb5m3YV
K0olAiPvsokwMB8GA1UdIwQYMBaAFFaOmsPwQt4YuUVVbvmTz+rD86UhMAwGA1Ud
EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBEG
CWCGSAGG+EIBAQQEAwIGQDAKBggqhkjOPQQDAgNIADBFAiEAi4Kl0vbKhLqtLd42
6SpN7ksgRrqrTtAQbuswtn7Yr4wCIAZ0QGqpMVT+IJ3GbSvfHapj2vyXUIeSae5j
V7bs4un6
-----END CERTIFICATE-----
Session timeout set to 500 seconds
Client Random : 1F0830B432AEF848A8F1B970D9D7B829F23A88B4191ADA69A4283BA3C7970E59
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    Session-ID: F8F809C15D9EC70A00A4196908A04532ABC68A539653BC07402EEE1D62B73BB9
    Session-ID-ctx:
    Master-Key: B8272A4D0A5A91D3642AA6ABB440DB53E69079285C4B0DB10B6911A5F0F3E93758993727559F6AFD39A1B5CA953C331B
    TLS session ticket: NONE
    Start Time: 1758580907
    Timeout   : 500 (sec)
    Extended master secret: no
I hear you fa shizzle!

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[gojimmypi]

Jenkins retest this please

For ERROR: wolfSSL » PRB-140-3-tests # 6526 was deleted Setting overall build result to FAILURE

[dgarske]

This PR doesn't make sense. If you need to trust more than one certificate just call wolfSSL_CTX_load_verify_buffer multiple times. If you need to have a chain to send to peer then build the combined certificate in memory. I don't like adding this to everyone's cert_test.h for an edge case.