ESP8266 Community Forum

- Wed Apr 26, 2017 2:11 am #65282

Can I ask also the locations of certificates?

Certificates are not flashed, see https://nodemcu.readthedocs.io/en/maste ... certverify

https://frightanic.com/
https://nodemcu-build.com/
https://github.com/marcelstoer/nodemcu-pyflasher

- Wed Apr 26, 2017 2:54 am #65285

Can I ask also the locations of certificates?

Certificates are not flashed, see https://nodemcu.readthedocs.io/en/maste ... certverify

Correct me if I'm wrong, but that's just server certificate. I need also a client authentication, so I need to store somewhere my client private key and my client public certificate. I saw that there are two python scripts which generate binaries to flash in the memory (make_cacert.py and make_cert.py, documented in the nonOS documentation from Espressif). Infact in app/modules/tls.c I found:
Line 27

Code: Select all__attribute__((section(".clientcert.flash"))) unsigned char tls_client_cert_area[INTERNAL_FLASH_SECTOR_SIZE];

which is then used in tls_cert:

Code: Select all// Lua: tls.cert.auth(true / false | PEM data [, PEM data] )
static int tls_cert_auth(lua_State *L)
{
  int enable;

  uint32_t flash_offset = platform_flash_mapped2phys((uint32_t) &tls_client_cert_area[0]);
  if ((flash_offset & 0xfff) || flash_offset > 0xff000 || INTERNAL_FLASH_SECTOR_SIZE != 0x1000) {
    // THis should never happen
    return luaL_error( L, "bad offset" );
  }

  if (lua_type(L, 1) == LUA_TSTRING) {
    const char *types[3] = { "CERTIFICATE", "RSA PRIVATE KEY", NULL };
    const char *names[2] = { "certificate", "private_key" };
    const char *error = fill_page_with_pem(L, &tls_client_cert_area[0], flash_offset, types, names);
    if (error) {
      return luaL_error(L, error);
    }

    enable = 1;
  } else {
    enable = lua_toboolean(L, 1);
  }

  bool rc;

  if (enable) {
    // See if there is a cert there
    if (tls_client_cert_area[0] == 0x00 || tls_client_cert_area[0] == 0xff) {
      return luaL_error( L, "no certificates found" );
    }
    rc = espconn_secure_cert_req_enable(1, flash_offset / INTERNAL_FLASH_SECTOR_SIZE);
  } else {
    rc = espconn_secure_cert_req_disable(1);
  }

  lua_pushboolean(L, rc);
  return 1;
}

To me it seems it is trying to read client certificate and key from flash memory (the binaries infact concatenate client certificate and key together), again correct me if I'm wrong.
Is there another way (maybe directly from lua) to expose client certificate to the server and using client private key to decrypt?
Thanks for the help.