<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Steve,<div class=""><br class=""></div><div class="">Mea culpa.</div><div class=""><br class=""></div><div class="">Here is the main cert:</div><div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div class=""><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">X509v3 Subject Alternative Name:</span></font></div><div class=""><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> DNS:*.<a href="http://openvehicles.com" class="">openvehicles.com</a>, DNS:<a href="http://openvehicles.com" class="">openvehicles.com</a></span></font></div></div><div class=""><div class=""><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Issuer: C=LV, L=Riga, O=GoGetSSL, CN=GoGetSSL RSA DV CA</span></font></div><div class=""><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Validity</span></font></div><div class=""><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not Before: Feb 11 00:00:00 2020 GMT</span></font></div><div class=""><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not After : Feb 10 23:59:59 2022 GMT</span></font></div></div></blockquote><div class=""><div><br class=""></div><div>Then the intermediate certs:</div><div><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Subject: C=LV, L=Riga, O=GoGetSSL, CN=GoGetSSL RSA DV CA</span></font></div></div><div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Issuer: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Validity</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not Before: Sep 6 00:00:00 2018 GMT</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not After : Sep 5 23:59:59 2028 GMT</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""><br class=""></span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Subject: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority</span></font></div><div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Validity</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not Before: May 30 10:48:38 2000 GMT</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not After : May 30 10:48:38 2020 GMT</span></font></div></div></div></blockquote><div class=""><div><br class=""></div><div>It seems the second intermediate certificate has expired, and that is perhaps the problem you are seeing?</div><div><br class=""></div><div>Very annoying. I really hate it when certificate authorities issue certificates signed by intermediate CA certificates, or trusted roots, that expire before the certificate itself.</div><div><br class=""></div><div>AddTrust has already issued a new intermediate cert which expires in 2038, and have managed to get that in as a trusted CA in most modern browsers. It is in my server’s bundle for older browsers, and is also in the OVMS firmware as a trusted CA. I guess wolfssl and mbedtls behave differently in this situation (where the same certificate is provided as a trusted CA as well as in the bundle, but with different expiration dates). Either that, or mbedtls is not verifying expired intermediate certs 😱</div><div><br class=""></div><div>I replaced that certificate on my server, and now see:</div><div><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Subject: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority</span></font></div></div><div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Issuer: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Validity</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not Before: Feb 1 00:00:00 2010 GMT</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> Not After : Jan 18 23:59:59 2038 GMT</span></font></div></div></blockquote><div class=""><div><br class=""></div><div>A test now looks ok:</div><div><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">$ openssl s_client -connect <a href="http://api.openvehicles.com:6870" class="">api.openvehicles.com:6870</a></span></font></div></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""><br class=""></span></font></div><div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">CONNECTED(00000005)</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">verify return:1</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">depth=1 C = LV, L = Riga, O = GoGetSSL, CN = GoGetSSL RSA DV CA</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">verify return:1</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">depth=0 CN = *.<a href="http://openvehicles.com" class="">openvehicles.com</a></span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">verify return:1</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">---</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class="">Certificate chain</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> 0 s:/CN=*.<a href="http://openvehicles.com" class="">openvehicles.com</a></span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> i:/C=LV/L=Riga/O=GoGetSSL/CN=GoGetSSL RSA DV CA</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> 1 s:/C=LV/L=Riga/O=GoGetSSL/CN=GoGetSSL RSA DV CA</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority</span></font></div><div><font face="Andale Mono" class=""><span style="font-style: normal; font-size: 12px;" class=""> i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority</span></font></div></div></blockquote><div class=""><div><br class=""></div><div>Can you try again? See if you still get an error?</div><div><br class=""></div><div>Regards, Mark.</div><div><br class=""></div><div><blockquote type="cite" class=""><div class="">On 4 Mar 2021, at 12:52 PM, Stephen Casner <<a href="mailto:casner@acm.org" class="">casner@acm.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Your server <a href="http://api.openvehicles.com" class="">api.openvehicles.com</a> on port 6870.<br class=""><br class="">On Thu, 4 Mar 2021, Mark Webb-Johnson wrote:<br class=""><br class=""><blockquote type="cite" class="">What site (and port) are you trying to access?<br class=""><br class=""><blockquote type="cite" class="">On 4 Mar 2021, at 12:09 PM, Stephen Casner <<a href="mailto:casner@acm.org" class="">casner@acm.org</a>> wrote:<br class=""><br class="">Mark,<br class=""><br class="">Thanks for that reply. As I mentioned, if I don't configure<br class="">WOLFSSL_ALT_CERT_CHAIN then I get an "ASN no signer to confirm"<br class="">error. Do you have any idea why that might be? That is, am I likely<br class="">to be missing access to some key? Of some key not being present in a<br class="">cert when it should be there?<br class=""><br class=""> -- Steve<br class=""><br class="">On Thu, 4 Mar 2021, Mark Webb-Johnson wrote:<br class=""><br class=""><blockquote type="cite" class="">Steve,<br class=""><br class="">A thorny issue. Servers are _supposed_ to provide intermediate certificates, up to a trusted root. When you are issued a certificate, it includes a bundle of these intermediary certificates to be installed at the same time. In practice, servers are often mis-configured so they do not. This is made worse by browsers silently detecting this, then downloading the missing intermediate certificates (the child certificate contains a URL to its parent's cert).<br class=""><br class="">For Open Vehicles, I don't think we need to deal with this, and we certainly don't need the complexity of automatically downloading intermediate certificates. I think if the user wants to access a server misconfigured in that way, he can simply import and trust the intermediate certificate directly.<br class=""><br class="">I don't think we should set WOLFSSL_ALT_CERT_CHAIN.<br class=""><br class="">Regarding your question, in normal operation OVMS as a client must validate the server certificates it connect to. I don't think OVMS currently supports client certificates, although if it did we would have to correctly provide those to the server on connection.<br class=""><br class="">Regards, Mark.<br class=""><br class=""><blockquote type="cite" class="">On 4 Mar 2021, at 9:00 AM, Stephen Casner <<a href="mailto:casner@acm.org" class="">casner@acm.org</a>> wrote:<br class=""><br class="">I find that I need to enable the following option in my testing of the<br class="">possible replacement of MEDTLS with WolfSSL, otherwise I get an "ASN<br class="">no signer to confirm" error:<br class=""><br class=""> WOLFSSL_ALT_CERT_CHAIN allows CA's to be presented by peer, but<br class=""> not part of a valid chain. Default wolfSSL behavior is to require<br class=""> validation of all presented peer certificates. This also allows<br class=""> loading intermediate CA's as trusted and ignoring no signer<br class=""> failures for CA's up the chain to root. The alternate certificate<br class=""> chain mode only requires that the peer certificate validate to a<br class=""> trusted CA.<br class=""><br class="">Is that expected for the trust arrangements we are using?<br class=""><br class="">A possibly related question: do we expect the server to validate<br class="">clients, or only the clients to validate the server?<br class=""><br class=""> -- Steve<br class=""></blockquote></blockquote></blockquote></blockquote>_______________________________________________<br class="">OvmsDev mailing list<br class=""><a href="mailto:OvmsDev@lists.openvehicles.com" class="">OvmsDev@lists.openvehicles.com</a><br class="">http://lists.openvehicles.com/mailman/listinfo/ovmsdev<br class=""></div></div></blockquote></div><br class=""></div></body></html>