Hello, I’m getting this problem with my TLS connection. I’m trying to connect to a file server ( https://files.000webhost.com/ ) using the COMODO CA as the following: -----BEGIN CERTIFICATE----- MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCB hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZ…

Hi @MattiaBerton Thank you for your question. Using debug_level=3 you will see that the verification flags are 4, which means: MBEDTLS_X509_BADCERT_CN_MISMATCH You will also see in the logs: Verify requested for (Depth 0): cert. version : 3 serial number : 31:5E:54:EA:E8:52:71:34:86:A3:…

Hello Ron, thank you for your answer. But something is not clear to me: why the CA provided is not correct since the CN field matches with the hostname I’m trying to connect to? Thank you, Mattia Berton

Hi Mattia, Why do you think the CA is not correct? The CA is correct, and another means of security is checking the subject name. The error you received is not because of the CA, but because the hostname did not match the subject_alt_name extension in the certificate Regards, Ron

Hello Ron, but if the hostname I’m connecting is files.000webhost.com and the certificate has subject_alt_name which includes *.000webhost.com, why you say that the hostname did not match the subject_alt_name extension in the certificate? Thank you, Mattia Berton

Hi Mattia, Have you called mbedtls_ssl_set_hostname() in your application to set the hostname? There is a difference between the server address that you are connecting to, and the hostname that is set in the tls session. The first is only networking connection, and the second is the name of the se…

Hello Ron, no, I didn’t call mbedtls_ssl_set_hostname in my application, but that’s because it is an example of ESP32 IDF which should work out-of-the-box. Also, the same example worked with “ https://bertronics.netsons.org/ ” with this certificate: -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQ…

Hi Mattia, The certificate you just posted is a CA certificate. The failure you encountered was on the server certificate. I tried connecting to bertronics, and I got same verification failure of the subject name vs. hostname CN comparison failure. Regards Ron.

ron - how does one do this? mbedtls_ssl_set_hostname (&ssl, “domainname”); ? I have the same issue using s3 on aws, handshake is failing. I do not have access to this structure (&ssl) from my application code. Thank you Tim

Hi Tim, If you do not have access to this structure, it probably means you are using some wrapper API on top of Mbed TLS. I suggest you look at the wrapper API, to see if there is some API that does this functionality. Regards

Thanks for your reply Ron, I’d been using the esp_idf example ota “simple_ota” which gives no visibility to the mbed libs. I switched to a more thorough example at [image] GitHub - RadialDevGroup/esp32-ota-https-example Contribute to RadialDevGroup/esp32-ota-https-example development by …

X509_verify_cert() returned -9984 (-0x2700)

Mbed TLS

roneld01 (Ron Eldor) July 15, 2019, 1:47pm 14

@JiriPelant
What doesmbedtls_ssl_get_verify_result() return?

Topic		Replies	Views
mbedTLS SSL handshake issue 2 Generic mbed_client , mbed_device_server , mbed_tls	25	30420	November 25, 2019
Connect to MQTT server Generic mbed_tls	22	5728	November 23, 2018
My own sample rootCA is failing on handshaking with aws Crypto and SSL questions	10	4913	January 15, 2020
I got an alert massage [2:40] can not understand why Mbed TLS	1	1066	February 13, 2022
MbedTLS handshake fail return -0x50 Bug Reports / Issues mbed_client	11	9102	May 20, 2019

X509_verify_cert() returned -9984 (-0x2700)

Related topics