Hi everyone,
I am using mbedtls 2.16.3 .
I use mbedtls library to create two level certificate and use the certificate to set up https communication.
The root certification(also be CA) is a self-signed certificate using ECC secp256r1.
The device certification is signed by the root certificate, and the key algorithm is also ECC secp256r1.
I install the root certification in the OS system and Firefox certification manager.
Chrome will show “Certificate Unknown” after receiving the certificate(The chrome version is 86.0.4240.75)
The wireshark shows as followings:
The chrome shows as followings:
NET::ERR_CERT_INVALID
Subject: 10.9.1.67
Issuer: Web Server Root
Expires on: 2021年10月13日
Current date: 2020年10月19日
PEM encoded chain:
-----BEGIN CERTIFICATE-----
MIIBejCCAR6gAwIBAgISANm85JYVS9N1992FvOfHxhsAMAwGCCqGSM49BAMCBQAw
JzELMAkGA1UEBhMCQ04xGDAWBgNVBAMMD1dlYiBTZXJ2ZXIgUm9vdDAeFw0yMDEw
MTYwMTIzMTdaFw0yMTEwMTMwMjQyNDRaMCExCzAJBgNVBAYTAkNOMRIwEAYDVQQD
DAkxMC45LjEuNjcwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATdpywNJKmMvDr2
esvqe9CVhjhQDgzzUo6WhMD91CosNJhkDtkMAbexQkq/je6IQyZABxFkiDMweLWe
uJR3rTbNoy4wLDAPBgNVHREECDAGhwQKCQFDMAkGA1UdEwQCMAAwDgYDVR0PAQH/
BAQDAgOoMAwGCCqGSM49BAMCBQADSAAwRQIgPRgDnfR7NIXfUlvaUyDtsIJDUGV2
BFKf7wxElxfbKDICIQDpVu5Ty9tZznQeuch+5LV0vDqXm6EWg+Viv6w5O59QIg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIBdDCCARigAwIBAgIRfRupqU8vSJw2LfGv1LSuXwAwDAYIKoZIzj0EAwIFADAn
MQswCQYDVQQGEwJDTjEYMBYGA1UEAwwPV2ViIFNlcnZlciBSb290MB4XDTIwMTAx
NjA5MjMxNloXDTQwMTAxNjA5MjMxNlowJzELMAkGA1UEBhMCQ04xGDAWBgNVBAMM
D1dlYiBTZXJ2ZXIgUm9vdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMZaKSeR
hoDgIeVbNkBYY0/n7z4JD+y+bZBXuDsFzYbz4odAe2C3WxpJ7fUw6sOCs1jpy8mv
neV1sRH3KXEXqNOjIzAhMA8GA1UdEwQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgKE
MAwGCCqGSM49BAMCBQADSAAwRQIgPa8BVP5Bt2YLQ3DHEbGsg79nJbtTSAKmAPaa
5NLEIEcCIQCENcnKEdTKV0L/1c3evynH/hP97mid58trLgBRlFU3Dw==
-----END CERTIFICATE-----
But the certification works well on Firefox/Edge.
And if I change the self-signed certificate to RSA 1024, the https connection in Chrome is okay.