CC3200MOD: Self signed CAcertificate always expire in one month

Rosario Borsellino

Part Number: CC3200MOD
Other Parts Discussed in Thread: CC3200

Hello everyone,
I'm facing a strange issue with a self signed certificate used by the mqtt client SSL connection, I generate a certificate that expires after 50 years, but one month after the certificate creation, the device returns the code -461 (connected with certificate date verification error) on connection. During the previous month I didn't have any issue on mqtt client connections.

I've followed the guide in the SDK documentation "CC32xx Serial Wifi.pdf" where I added the -days option when generating CA file, here my openssl commands to generate the certificate:

# Generate a CA certificate valid for 50 years:
$ openssl req -out CAroot.pem -new -x509 -days 18250
# this command create CAroot.pem and privkey.pem files.

# Generate server certificate/key pair:
$ openssl genrsa -out server.key 1024
$ openssl req -key server.key -new -out server.req -days 18250
$ echo 00 > file.srl
$ openssl x509 -req -in server.req -CA CAroot.pem -CAkey privkey.pem -CAserial file.srl -out server.pem
# these commands create server.key and server.pem files

# Translate CA certificate to DER format (to be read from the device):
$ openssl x509 -in CAroot.pem -inform PEM -out CAroot.der -outform DER

Then I flash the /crt/CAroot.der file on the CC3200, my mqtt client configuration is the following:

 
char *security_file_list[] = {"/crt/CAroot.der"};
 
SlMqttClientCtxCfg_t broker_config =
{
    {
        SL_MQTT_NETCONN_SEC,
        "192.168.1.120",
        8884,
        SL_SO_SEC_METHOD_TLSV1_2,
        SL_SEC_MASK_TLS_RSA_WITH_AES_256_CBC_SHA,
        1,
        security_file_list
    },
    SERVER_MODE,
    true,
};

I also tried with 90 days, but configuring a date farther than 30 days from today on the server and the device, the -461 error will be returned by the sl_Connect() function.

Am I doing something wrong?
Is there any configuration that I'm missing?

Thanks.

Regards,
Rosario

over 8 years ago

0 Rosario Borsellino over 8 years ago

Intellectual 290 points

Hello,
I've found my mistake: the commands "openssl x509" also needs the -days option.
Now I use these commands:

# Generate a CA certificate valid for 50 years:
$ openssl req -out CAroot.pem -new -x509 -days 18250
# this command create CAroot.pem and privkey.pem files.

# Generate server certificate/key pair:
$ openssl genrsa -out server.key 1024
$ openssl req -key server.key -new -out server.req -days 18250
$ echo 00 > file.srl
$ openssl x509 -req -in server.req -CA CAroot.pem -CAkey privkey.pem -CAserial file.srl -out server.pem -days 18250
# these commands create server.key and server.pem files

# Translate CA certificate to DER format (to be read from the device):
$ openssl x509 -in CAroot.pem -inform PEM -out CAroot.der -outform DER -days 18250

The mistake was to look in the certificate visualizer that still said expire date 2067 when I opened the CAroot.der file

Now next issue: with the above certificates I'm able to connect to the server until 06 february 2036 that is 6684 days from now.
If I generate a certificate valid for 6679 days (that will expire on 02 february 2036) I'm correctly able to connect until 01 feb 2036.
Is this a known limitation of the simplelink?

These test are done modifying dates in this way:
- on the server with the command: date -s "YYYY-MM-DD HH:MM"
- on the CC3200 with the command: sl_DevSet(SL_DEVICE_GENERAL_CONFIGURATION, SL_DEVICE_GENERAL_CONFIGURATION_DATE_TIME, sizeof(SlDateTime_t),(unsigned char *)(&g_time));

As this issue is now not related with the month expire, tell me if is better to close this thread and open a new one.

Thanks to anyone that was already checking for the previous issue.

Regards,
Rosario

0 Sarah P over 8 years ago in reply to Rosario Borsellino

TI__Mastermind 38980 points

Hi Rosario,

I'm glad your issue was resolved! Thanks for sharing the solution.

Best regards,
Sarah

Wi-Fi

Wi-Fi forum

CC3200MOD: Self signed CAcertificate always expire in one month