ESP8266 Community Forum

- Sat May 30, 2015 5:27 am #18948 SHA-1 is depressed due to security problem, people are migrating to SHA-2 signed certificate. But I'm unable to make ESP8266 working with the new SHA-2 https certificate. The reconnect_cb was called with error number -28.

I've looked into the old 0.9.4 SDK which ssl related codes are still opensource, and find it indeed leak of SHA-2 support. But I can do nothing except begging you staffs to support it because SDK 1.1.0 are no longer providing libssl with source opened.

Websites with SHA-1 certificate are no longer safe and will got a big Red warning in the new version of Chome(http://blog.chromium.org/2014/09/gradua ... sha-1.html). So not only we but almost every websites need to upgrade to SHA-2 certificate ASAP.

P.S. A good web-based tool that can tell you much more about your website's https related problem:
https://www.ssllabs.com/ssltest/analyze ... com&latest
It rated grade A to our server, but failed to connect from ESP8266 now : (
https://www.ssllabs.com/ssltest/analyze ... odelua.org

P.P.S. The certificate of espressif.com was EXPIRED 50 days ago!!!

- Tue Jun 02, 2015 1:31 am #19188 Fine...I've found it would be unnecessary to make SHA2 supports for 8266.
SHA1 or SHA2 are used to verify server certificate, to make sure the server we are connecting is *REALLY* our server.

But, the RAM on 8266 is so limited that we virtually can not do any kinds of verification:
before ssl_verify_cert(), free=2776 (only 2.7KB heap was free!!! The CA-root certificate sized 3KB+ is unattached yet!)
enter ssl_verify_cert()
die, and watch dog reset...

As a result, I think the HTTPS connections from ESP8266 are actually unsafe, something like man-in-the-middle attack can easily be made.

P.S. The examples in the SDK has SSL_SERVER_VERIFY_LATER flag on ssl_ctx->options and the global certificate char *default_certificate was used with option "SSL_OBJ_X509_CERT"(that loads a client side certificate), which means it would not verify server certificate by default. So it *SEEMS* that the HTTPS are working - even if a men in the middle redirecting the data stream with a faked server : (

- Tue Jun 02, 2015 2:00 am #19192 hey, thanks for highlighting this!

Some of my work

- Tue Jun 16, 2015 9:11 pm #20646 Hi，

The latest SDK_v1.1.2 added CA verify function http://bbs.espressif.com/viewtopic.php?f=5&t=591

Document about SSL in \esp_iot_sdk_v1.1.2\document\SSL

Could it help ?