This example demonstrates the AM2x device in the form of an HTTPS server which accepts client connections and sends a fixed response back. Here, MbedTLS was used with LwIP to attain the complete functionality.

A top-level working of HTTPS server is described below:

Role of MbedTLS:

• A TLS config using the server certificate, private key, password for accessing the private key (optional) is created. A standard allocator function creates an altcp PCB for TLS over TCP.
• The certificate and private key is loaded. Then based on the format of the x509 certificate (DER or PEM), the certificate and keys are parsed.
• The modulus of the private key is compared with the modulus of the public key present in the certificate. The certificate is signed with private key of trusted CA.
• The public key is used to verify the above signature. If the verification is complete, then next steps are executed.
• Pass the TLS config to LwIP application APIs, which internally use the same TLS config in PCB (Process Control Block of the corresponding TCP connection).
• Using mbedTLS cryptographic functions, certificates and keys are verified. If any parsing error or data inconsistency, certificate and keys invalidation occur, the ongoing network connection is dropped.

Role of LwIP:

• A LwIP PCB is set up and the PCB is then bind to the defined port (8080 in case of HTTPS). Then the PCB binds the connection to the local port number and IP address, which in this case is attained by a DHCP server.
• Then the state of TCP connection is set to LISTEN (mode to accept new connections).
• An altcp_accept callback is set, which handles new incoming connections, allocates memory to manage the connection state, sets callbacks for sending, receiving, error handling and polling.
• The http_recv callback on getting data, informs TCP PCB that data has been received, then parses the data.
• The http_poll callback polls the other side of the connection every 2 seconds, if data is not received for 8 seconds, the connection is closed.
• The http_err callback closes the connection and frees the resources when error emerges.
• The http_sent callback function is responsible for sending data and getting acknowledgment from the remote host.

Figure 3-2 demonstrates the same with SA2UL cryptography accelerator being used for cryptography (optional). The other alternative is to use MbedTLS software cryptography instead of offloading it to hardware.

Figure 3-2 Overview of How HTTPS Server Example Works End to End

For further details, see: AM243x MCU+ SDK: CPSW Lwip HTTPS Server Example