• State TI Thinks Resolved
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 40 subscribers
  • Views 614 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

RTOS/CC3100SDK: Dynamically Determine Root CA

Tim Roadley
Intellectual 730 points

Part Number: CC3100SDK
Other Parts Discussed in Thread: CC3120, CC3100

Tool/software: TI-RTOS

Hi,

I've been using HTTPCli_connect to connect to an endpoint with TLS.

This was working fine, until the people who manage the endpoint changed their root CA. Now I'm getting an error -102.

While I can probably fix this by updating tlsParams.ca with the new root ca, I was wondering if there's a dynamic way to do this irrespective of root ca? For example, your browser must do this so why could my TI device not?

Thanks in advance for your advice!

Cheers

  • 0
    TI__Mastermind 40965 points

    Hi Tim,

    Dynamically determining the root CA might be possible with the CC3100 using a method from the CC3120. On the Gen2 parts, if you attempt to make a connection with the wrong root CA, then a socket async event is triggered with the passed data indicating the correct root CA to provide for that host.

    This SimpleLink academy module is not for the CC3100, but task 2 of the module containts the clearest explanation of how you would go about using that async event to determine the correct root CA to use. 

    CC3220 OTA SLA

    Unfortunately, I am not sure whether the CC3100 supports this root CA determination feature, seeing how that SL_SSL_NOTIFICATION_WRONG_ROOT_CA define is missing from the CC3100 socket.h header file. If you could give it a try and see if it works, that would be great. I would test it myself, but I do not have the necessary hardware with me at the moment. When I get back to the office on Monday I'll give this method a try if you haven't already, and let you know if it works or if an alternate approach is required.

    Regards,
    MIchael

  • 0 in reply to Michael Reymond
    Intellectual 730 points

    Hi Michael,

    Thanks for your reply. Unfortunately the link to 'CC3220 OTA SLA' was broken. Is there a different link I could use?

    I will search around myself in the meantime in case I have any luck.

    Cheers,

    Tim

  • 0 in reply to Tim Roadley
    TI__Mastermind 40965 points

    HI Tim,
    If you go to dev.ti.com/tirex and then use the left pane to navigate to the SLA:
    software -> simplelink cc3220 sdk -> simplelink academy -> labs -> wifi _> wifi OTA
    you should be able to access the SLA. Sorry about the broken link.

    You can also access the image of interest with the code you should try here:
    dev.ti.com/.../ota_sockeventhandler.png

    SL_SSL_NOTIFICATION_WRONG_ROOT_CA is defined as 5 by the way. As I mentioned in my previous post, it won't be defined in your socket.h, so you'll have to put case: 5.

    Hope that helps,
    Michael