SWRU455M February 2017 – October 2020 CC3120 , CC3120MOD , CC3130 , CC3135 , CC3135MOD , CC3220MOD , CC3220MODA , CC3220R , CC3220S , CC3220SF , CC3230S , CC3230SF , CC3235MODAS , CC3235MODASF , CC3235MODS , CC3235MODSF , CC3235S , CC3235SF
Set filenames to be used during the TLS handshake. The files must be programmed to the NWP file system. The files should be in PEM or DER format. The client can successfully connect to a server that does not require client authentication without any files (the server would not be verified, because no root CA is programmed). The server must provide a server certificate during the TLS handshake, and therefore the sl_SetSockOpt command must be used to provide the certificate and private key of the server.
DH files are Diffie Hellman parameters files. These parameter files contain parameters for generating a DH key when using DHE cipher suites in server mode.
In server mode; if there is no DH file, the DH cipher suites are not available, even if a secured mask is used to peek certain cipher suites with DH. If an ECDSA signature is used in the server certificate, the RSA ciphers are not available and vice versa.
File | Client | Server |
---|---|---|
Root CA file Format: PEM/DER. The self-signed certificate that signed the other peer chain | Validates the remote peer (the remote server) If file does not exist, connection success with error SL_ERROR_BSD_ESECSNOVERIFY | Enables client verification when programmed (not mandatory). If programmed and peer did not send its certificate, a socket asynchronous event is raised with error SL_ERROR_BSD_ESEC_NO_PEER_CERT. |
Cert Format: PEM/DER. A certificate issued to this peer side. | Client Cert or certificate chain if server requires client authentication. Chain can only be programmed in a PEM format, where the client certificate is the first, followed by all the intermediate CAs. If file does not exist, and the server requires client authentication, the server returns ALERT of peer verify error in the sl_Connect command. The user must program private key with this file, or else connection fails with SL_ERROR_BSD_ESECBADPRIVATEFI LE. | Server certificate or certificate chain. Chain could only be programmed in PEM format. The server cert should be the first in the list. The file must be configured. If not configured, error SL_ERROR_BSD_ESECBADCERTFILE occurs. |
Private Key Format: PEM/DER. RSA or ECDSA key. | Client private key if server requires client auth. The user must program cert with this file, or else connection fails with SL_ERROR_BSD_ESECBADCERTFILE. | The private key of the server. Must be configured. If not configured, error SL_ERROR_BSD_ESECBADPRIVATEFILE is raised. |
DH (server) or PEER Cert (client) Format: PEM/DER. Other side certificate or DH parameters. | Configuring this file enables the domain verification by full server cert comparison. This file is the server expected cert. This is being compared to the server certificate that was received from the server during the handshake phase, to validate that this is truly the domain to connect to (stronger than the domain name verification). | DH file –Diffie Hellman parameters file. Contains parameters for generating DH key when using DHE cipher suites in server mode. Enables the DH ciphers. |
Binding a file to a socket is done using sl_SetSockOpt, before the sl_Connect or sl_Listen commands.
Example:
_i16 status;
status = sl_SetSockOpt(sd,SL_SOL_SOCKET,SL_SO_SECURE_FILES_CA_FILE_NAME,"ca.der",strlen("ca.der"));
For unique device authentication it is possible to create a unique device key pair with the crypto utils (see Section 18) and use the keys to either create a CSR for external certificate signing or create a self signed certificate. The unique device key is stored on the device's file system as system file and cannot be accessed from the application processor. The unique key path and the certificate path of the created key could be used as the input values for the private key of one of the value in the table above.