SWRU455M February 2017 – October 2020 CC3120 , CC3120MOD , CC3130 , CC3135 , CC3135MOD , CC3220MOD , CC3220MODA , CC3220R , CC3220S , CC3220SF , CC3230S , CC3230SF , CC3235MODAS , CC3235MODASF , CC3235MODS , CC3235MODSF , CC3235S , CC3235SF
The HTTP server can accept connections over a secure socket (TLS). When enabled, the primary server port accepts only secure connections, and unsecure connection requests are rejected. The secondary port can be enabled to redirect nonsecure connection attempts to the primary (secure) port. This scheme is commonly used to redirect browsers, which by default initiate a nonsecure connection on port 80. When the secure connection is enabled, a server certificate and a private key must be placed on the file system in PEM or DER format, and their names must be configured in the HTTP server. The following example shows how to enable the secure socket and use the secondary socket for redirection.
unsigned char ServerCertificateFileName[] = "server-cert.der";
unsigned char ServerKeyFileName[] = "server-key.der";
unsigned char SecurityMode[] = {0x1};
unsigned char HttpsPort[] = {0xBB, 0x01}; // 0x1BB = 443unsigned char SecondaryPort[] = {0x50, 0x00}; // 0x050 = 80unsigned char SecondaryPortEnable[] = {0x1};
// Set the file names used for TLS key exchange.
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID,
SL_NETAPP_HTTP_DEVICE_CERTIFICATE_FILENAME,
sizeof(ServerCertificateFileName),
ServerCertificateFileName);
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID,
SL_NETAPP_HTTP_PRIVATE_KEY_FILENAME,
sizeof(ServerKeyFileName),
ServerKeyFileName);
// Activate TLS security on primary HTTP port and change it to
// 443 (standard HTTPS port)
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID,
SL_NETAPP_HTTP_PRIMARY_PORT_SECURITY_MODE,
sizeof(SecurityMode),
SecurityMode);
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID,
SL_NETAPP_HTTP_PRIMARY_PORT_NUMBER,
sizeof(HttpsPort),
HttpsPort);
// Enable secondary HTTP port (can only be used for redirecting
// connections to the secure primary port).
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID,
SL_NETAPP_HTTP_SECONDARY_PORT_NUMBER,
sizeof(SecondaryPort),
SecondaryPort);
sl_NetAppSet(SL_NETAPP_HTTP_SERVER_ID,
SL_NETAPP_HTTP_SECONDARY_PORT_ENABLE,
sizeof(SecondaryPortEnable),
SecondaryPortEnable);
// Restart HTTP server for new configuration to take effect.
sl_NetAppStop(SL_NETAPP_HTTP_SERVER_ID);
sl_NetAppStart(SL_NETAPP_HTTP_SERVER_ID);
It is also possible to require client authentication by providing a Root CA file using the SL_NETAPP_HTTP_CA_CERTIFICATE_FILE_NAME option. If provided, all client connections are verified, and those failing the test are not accepted. TLS client verification is described in more detail in Section 6.3.
Currently internal HTTPs server supports only RSA cipher suite due to performance optimization.