CC3235MODASF: CC3235SF HTTPS Server Connection Fails, HTTP Works

Ryan Chen

Prodigy 70 points

Part Number: CC3235MODASF
Other Parts Discussed in Thread: CC3235SF

Hi Ti,

I am trying to set up an HTTPS server on CC3235SF and cannot connect via HTTPS. Details are as follows:

Environment and Certificate Generation:

OpenSSL version: OpenSSL 3.6.1 27 Jan 2026
Commands used to generate key and certificate:

openssl genrsa -out server-key.pem 2048

openssl req -new -x509 ^
-key server-key.pem ^
-out server-cert.pem ^
-days 365 ^
-sha256

openssl x509 -in server-cert.pem -out server-cert.der -outform DER
openssl rsa -in server-key.pem -out server-key.der -outform DER
Placed server-cert.der and server-key.der into the project /userFile/certs/ directory.

HTTPS Server Setup in Code:

unsigned char ServerCertificateFileName[] = "/certs/http_cert.der";
unsigned char ServerKeyFileName[] = "/certs/http_key.der";
unsigned char SecurityMode[] = {0x1};
unsigned char HttpsPort[] = {0xBB, 0x01}; // 443
unsigned char SecondaryPort[] = {0x50, 0x00}; // 80
unsigned char SecondaryPortEnable[] = {0x1};

// Set certificate and private key
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID, SL_NETAPP_HTTP_DEVICE_CERTIFICATE_FILENAME, sizeof(ServerCertificateFileName), ServerCertificateFileName);
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID, SL_NETAPP_HTTP_PRIVATE_KEY_FILENAME, sizeof(ServerKeyFileName), ServerKeyFileName);

// Enable HTTPS on primary port
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID, SL_NETAPP_HTTP_PRIMARY_PORT_SECURITY_MODE, sizeof(SecurityMode), SecurityMode);
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID, SL_NETAPP_HTTP_PRIMARY_PORT_NUMBER, sizeof(HttpsPort), HttpsPort);

// Enable secondary port for HTTP redirect
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID, SL_NETAPP_HTTP_SECONDARY_PORT_NUMBER, sizeof(SecondaryPort), SecondaryPort);
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID, SL_NETAPP_HTTP_SECONDARY_PORT_ENABLE, sizeof(SecondaryPortEnable), SecondaryPortEnable);

// Restart HTTP server
sl_NetAppStop(SL_NETAPP_HTTP_SERVER_ID);
sl_NetAppStart(SL_NETAPP_HTTP_SERVER_ID);

Observed Behavior:

http://<IP> works correctly.
https://<IP> or https://<IP>:443 fails with ERR_CONNECTION_REFUSED in the browser.
All sl_NetAppSet and sl_NetAppStart calls return 0 (success), no errors.

What I Have Checked / Tried:

Both DER and PEM formats for certificates.
Confirmed the certificate and private key use RSA.
SecurityMode set to 0x1 (TLS enabled).
Secondary HTTP port enabled for redirect, still cannot connect.
Browser does not have the self-signed certificate installed.

Questions:

Should the HTTPS server be configured before or after Wi-Fi connection?
Besides sl_NetAppSet and sl_NetAppStart, are there other required steps (e.g., certificate format, permissions, file path)?
Does the PC browser need to install the self-signed certificate to connect?
Are there recommended ways to test or verify that the HTTPS server is actually running (e.g., port checking)?

5 months ago

0 Ryan Chen 5 months ago

Prodigy 70 points

Dear TI Support Team,

I would like to clarify the current HTTPS behavior observed during testing.

When using the SDK-provided certificates (e.g., dummy-trusted-ca-cert and dummy-trusted-ca-cert-key), the HTTPS server works correctly. The TLS handshake completes successfully, and communication is established. Although the browser shows ERR_CERT_AUTHORITY_INVALID, the connection itself functions as expected.

However, when I generate my own certificate and private key using OpenSSL and load them into the device, the HTTPS connection consistently results in a timeout. The browser cannot establish a TLS session at all.

This suggests that the HTTPS server configuration is correct, since it works with the SDK dummy certificates. The issue appears to be related specifically to the format or properties of the self-generated certificate and/or private key.

Could you please advise:

Are there specific requirements for certificate format (PEM/DER, PKCS#1 vs PKCS#8)?
Are there mandatory extensions or key usage fields required by the NWP TLS stack?
Are there known constraints on signature algorithm, key size, or encoding?

If needed, I can provide the OpenSSL commands used to generate the certificate for further analysis.

Thank you for your support.

0 Shlomi Itzhak 5 months ago in reply to Ryan Chen

TI__Guru 66295 points

Hi,

Thanks for verifying it works with the dummy certificates.

can you provide the commands you followed to create the certificates?

Also, can you attach the server certificate itself? (it is not a secret, I do not need the matching key)

Basically, when a browser connects to a server it gets the certificates chain and then validates the chain and eventually also validates the root certificate against its internal root CA store. But, even if it is not in the store (and probably it is not since it was not signed by an authorized root CA, like the dummy is not), it should allow you to connect if you choose to trust the certificate (and then you get a padlock with a sign to show it).

So I assume that in your case the chain is not valid or the bottom certificate is not of CA type, etc.

Regards,

Shlomi

0 Ryan Chen 5 months ago in reply to Shlomi Itzhak

Prodigy 70 points

Dear TI Support Team,

Thank you for your explanation regarding the certificate chain validation process.

Below are the OpenSSL commands I used to generate the certificate and key:

openssl genrsa -out server-key.pem 2048
openssl req -new -x509 -key server-key.pem -out server-cert.pem -days 365 -sha256
openssl x509 -in server-cert.pem -out server-cert.der -outform DER
openssl rsa -in server-key.pem -out server-key.der -outform DER

The generated certificate is self-signed and does not involve a separate Root CA or Intermediate CA.

When this certificate is loaded into the device, the HTTPS connection consistently results in a timeout during TLS handshake. However, when using the SDK dummy certificates, HTTPS works correctly (with ERR_CERT_AUTHORITY_INVALID in the browser, as expected).

Based on your explanation, I suspect the issue may be related to one of the following:

The certificate chain structure (since I am using a self-signed certificate rather than a CA-signed chain)
Missing required X.509 extensions (basicConstraints, keyUsage, extendedKeyUsage, etc.)
The bottom certificate not being marked appropriately (CA / CA)
Specific TLS constraints enforced by the NWP

Could you please clarify:

Does the SimpleLink HTTPS server require a CA-signed server certificate?
Is a full certificate chain required to be provisioned?
Are there mandatory X.509 extensions required by the NWP TLS stack?
Are self-signed certificates supported, and if so, what constraints must they meet?

I have attached the generated server certificate (PEM format) for your review.

Thank you for your assistance.

Best regards,
Ryan

0 Ryan Chen 5 months ago in reply to Ryan Chen

Prodigy 70 points

Dear TI Support Team,

I performed additional testing regarding the certificate format.

Using the following commands, I generated a self-signed certificate:

openssl genrsa -out server.key 2048
openssl req -new -x509 -key server.key -days 365 -sha256 -out server.crt

When loading the PEM certificate (server.crt) and corresponding key into the device, HTTPS works correctly.

However, after converting both the certificate and key to DER format:

openssl x509 -in server.crt -out server.der -outform DER
openssl rsa -in server.key -out server.key.der -outform DER

and provisioning the DER files instead, the HTTPS connection consistently results in a timeout.

This suggests that the issue is not related to certificate extensions or chain validation, but rather to how the HTTP server/NWP parses DER formatted certificates.

Could you please confirm whether the SimpleLink HTTP server fully supports DER formatted certificates for SL_NETAPP_HTTP_DEVICE_CERTIFICATE_FILENAME and SL_NETAPP_HTTP_PRIVATE_KEY_FILENAME, or if PEM format is required?

Thank you for your assistance.

Best regards,

Ryan

0 Shlomi Itzhak 5 months ago in reply to Ryan Chen

TI__Guru 66295 points

Hi,

As far as I remember it can get both DER and PEM but I haven't checked it lately.

Looking at the user guide, it does mention PEM only but without checking I cannot guarantee for sure.

This is the table:

Shlomi

Wi-Fi

Wi-Fi forum

CC3235MODASF: CC3235SF HTTPS Server Connection Fails, HTTP Works