Custom CA certificate
torntrousers opened this issue · 3 comments
I'm trying to use ArduinoBearSSL on an Arduino Nano 33 IoT board to talk to a server that requires mutual TLS, but can't get it to work. I'm guessing its because the server is using a custom certificate which ArduinoBearSSL doesn't know about.
I've tried using setInsecure(BearSSLClient::SNI::Insecure) but that I think must also disables presenting the client certificate thats set with sslClient.setEccSlot call, so the TLS connection still fails.
How can I set a custom CA certificate? Is there any API to do that?
TIA!
You can provide your custom CA certificate thanks to Trusted Anchors:
BearSSLClient sslClient(nbClient,TAs,1);
TAs can be formatted from PEM file thanks to brssl tool (available from https://www.bearssl.org/git/BearSSL):
brssl ta custom_ca.pem
That's correct, thank you @ffontaine 🚀
It should also be noted that you must also provide the correct time through ArduinoBearSSL.onGetTime for the certificate validation (see the examples).