HTTPS client demo

Fortunato Marrelli

Other Parts Discussed in Thread: CC3200, CC3200MOD

Hi,

I have to connect to https://api.my-ip.io/ip to get IP of the router which the board is connected to.

If i use http_client_demo, the server correctly reply 301 and specify the resource has been moved to https://api.my-ip.io/ip,

so how to make a secure connection?

I followed the indication https://e2e.ti.com/support/wireless-connectivity/wi-fi-group/wifi/f/wi-fi-forum/600176/cc3200-launchxl-cc3200-https-client-connection-to-server-failed-error--102

but I have a question, should I have to generate a certificate if I do not have mutual TLS authentication?

I do not think that connecting to https://api.my-ip.io/ip I need mutual autentication.

In such case how do I change security params?

struct HTTPCli_SecureParams sparams;

What is sparams.cafile content?

Best Regards

over 1 year ago

0 Kobi Leibovitch over 1 year ago

TI__Guru 63006 points

When you only use server authentication, you will need to have the Server's root CA certificate on the CC3200 file system.

cafile is this root ca file name.

Please refer to chapter 8.2 in https://www.ti.com/lit/pdf/swru368 for more detail. Note that the http stack (and the HTTPCli_SecureParams parameters) will be used to initiate the secure socket as listed in the document.

0 Fortunato Marrelli over 1 year ago in reply to Kobi Leibovitch

Prodigy 185 points

Hi,

thanks for reply. I contacted administrator of the site https://api.my-ip.io/ip,

to ask if I need certificate.

His reply was: "The SSL is server side only". So do I need Certificate? I think no.

So now I am stuck.

If I connect using http it redirects me, if I connect using https it cannot connet. Reply -102.

I am using SDK 1.1.0 and CC3200.

If I use https://www.ssllabs.com/ssltest/ the reply of the site is that it supports TLS 1.2.

Best Regards

0 Fortunato Marrelli over 1 year ago in reply to Kobi Leibovitch

Prodigy 185 points

Hi,

Yes, I use HTTPCli_SecureParams as in many examples I saw in this forum where they have the same problem -102.

It does not look any of them solved the problem.

And I also read swu368 at paragraph 8.2.2.3 at client. Root CA is not mandatory, at least the server replies SL_ESECSNOVERIFY which can be ignored.

So please , could you help me.

Maybe I should create a self signed certificate?

Best Regards

0 Kobi Leibovitch over 1 year ago in reply to Fortunato Marrelli

TI__Guru 63006 points

you don’t need a client certificate. but you do need to have the root ca that signed the server’s certificate.

0 Fortunato Marrelli over 1 year ago in reply to Kobi Leibovitch

Prodigy 185 points

Ok,

Please, one more information. The root CA should be flashed as user file in the board.

But where do I find the root CA? Do I have to follow the indication to generate CA described in

appendix C of swru368c.pdf?

Thanks very much

+1 Kobi Leibovitch over 1 year ago in reply to Fortunato Marrelli

TI__Guru 63006 points

No. This appendix talks about how to generate your own certificate.

What you need is to find the Server's certificate (the one that it sends during TLS negotiation) and figure out what is the root CA that used to sign it.

This is the certificate that needs to be in the file system (and in setsockopt).

you can contact the server to ask for this, or you can check with different methods such as through a sniffer or by checking the connection in a PC browser (see more details in https://www.ti.com/lit/pdf/swpu332, specifically in chapter 2.5.1 - but note that the embedded method mentioned is for CC322x/3x and won't work with the older CC3200).

0 Fortunato Marrelli over 1 year ago in reply to Kobi Leibovitch

Prodigy 185 points

I do not know If I will be able to connect but thanks for informations.

Unfortunately I have a CC3200 board. Anyway https://www.sslchecker.com/sslchecker allows me to download the certificate and I will try this.

Maybe in the next future i Will move to CC3220. Pity I have three CC3200Mod left.

Best Regards

**Attention** This is a public forum

API solutions

API solutions Forum

HTTPS client demo