Defines which files the socket will use for the connection. There are four files that can be attached to a socket:
- Private key
- Certificate
- Root CA
- DH file
These are the files in client and server sockets:
Client
- Private Key, Certificate – If a client must be authenticated by the server, both private key and certificate are mandatory together. Use two setsockopt commands to configure each file.
- Root CA – This is the root certificate authority that issued the server certificate and is used to validate that the server is authentic. This file is not mandatory. If the server is not verified, the connection occurs, but the connect command returns an error, SL_ESECSNOVERIFY. This error can be ignored as it is only a warning for an unauthenticated connection.
- DH file – No use in client
Server
- Private Key, Certificate – Mandatory for server
- Root CA – The certificate issued to the client. When file is set, it obligates the client to send their certificate for client authentication.
- DH file – Used to support the DH cipher suit – TLS_DHE_RSA_WITH_AES_256_CBC_SHA.
To bind files to a socket, program the file to the device. Then use the setsockopt to enter the file name. All secured files must be in DER format.
Setsockopt options for the secured files:
- SL_SO_SECURE_FILES_PRIVATE_KEY_FILE_NAME
- SL_SO_SECURE_FILES_CERTIFICATE_FILE_NAME
- SL_SO_SECURE_FILES_CA_FILE_NAME
- SL_SO_SECURE_FILES_DH_KEY_FILE_NAME
For example, use the file rootCA.der that is in the device:
Sl_SetSockOpt(sockID, SL_SOL_SOCKET, SL_SO_SECURE_FILES_CA_FILE_NAME,”rootCA.der”, strlen(“rootCA.der”));
Note the strlen in the setsockopt, and not sizeof.