Question
ThreadX issue with TLS client when running v1.3
Hello,
I encounter a problem with creating a TLS client connection with a client certificate and private key.
The server side is Ubuntu based with OpenSSL 3.0.13 30 Jan 2024.
Server certificate validation works without any problems.
But a weird issue happens when I want to add a client-side certificate with a private key.
OpenSSL ends with a weird error: [ERROR] header too long
Running on STM32H5 - ThreadX Version 6.2.0
The server has the following options:
mode = 'server',
protocol = 'tlsv1_3',
key = options.ssl..'/server.priv',
certificate = options.ssl..'/server.crt',
cafile = options.ssl..'/client.crt',
verify = { 'peer', 'fail_if_no_peer_cert' },
options = { 'all', 'no_sslv2', 'no_sslv3', 'no_tlsv1', 'no_tlsv1_1' }
When I switch the server side to tlsv1_2 everything works as expected
When I disable 'peer', 'fail_if_no_peer_cert' and keep 'tlsv1_3' it also works
But with both options, it just does not work.
The connection from the client using OpenSSL works as expected in all modes, so the problem is only with ThreadX against OpenSSL in 1.3 mode.
Used certificates are using:
Signature Algorithm: ecdsa-with-SHA256
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
ASN1 OID: prime256v1
NIST CURVE: P-256
and key:
EC key
Private-Key: (256 bit)
ASN1 OID: prime256v1
NIST CURVE: P-256
When I disable 'peer', 'fail_if_no_peer_cert' and keep 'tlsv1_3' it also works
But with both options, it just does not work.
The connection from the client using OpenSSL works as expected in all modes, so the problem is only with ThreadX against OpenSSL in 1.3 mode.
Used certificates are using:
Signature Algorithm: ecdsa-with-SHA256
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
ASN1 OID: prime256v1
NIST CURVE: P-256
and key:
EC key
Private-Key: (256 bit)
ASN1 OID: prime256v1
NIST CURVE: P-256