Tls on esp8266 - Revision history

Tim: /* TLS on esp8266 */

2019-03-05T15:05:56Z

TLS on esp8266

← Older revision		Revision as of 11:05, 5 March 2019
Line 1:		Line 1:
	===TLS on esp8266 ===		==TLS on esp8266 ==
			*back to [[TLS_SSL]]

	====refs====		====refs====

Tim at 16:57, 3 February 2017

2017-02-03T16:57:25Z

@@ Line 143: / Line 143: @@
 *[http://www.instructables.com/id/ESP8266-based-web-configurable-wifi-general-purpos-1/ web based configuration]
-==== openssl ====
+{{:openssl}}
 ====node ====

Tim at 22:07, 20 January 2017

2017-01-20T22:07:15Z

← Older revision		Revision as of 18:07, 20 January 2017
Line 12:		Line 12:
	https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs		https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs

	Normally one would want the baddest certifcate you can get, un-deciferable cifers, un-stealable keys ...		me: Normally one would want the baddest certifcate you can get, un-deciferable cifers, un-stealable keys ...

	I have a different need, a dumbed down tls1.1 small key/cipher/cert that will work on esp8266's, these tiny, wifi enabled, mqtt protoocol running, $2, iot devices. OK so I made a 512byte private key. Now I need to make a cert and a sha-1 thumbprint that will work with small memory devices using tls1.1, TLSRSAWITHAES128CBCSHA or RC4-MD5 ciphers.		I have a different need, a dumbed down tls1.1 small key/cipher/cert that will work on esp8266's, these tiny, wifi enabled, mqtt protoocol running, $2, iot devices. OK so I made a 512byte private key. Now I need to make a cert and a sha-1 thumbprint that will work with small memory devices using tls1.1, TLSRSAWITHAES128CBCSHA or RC4-MD5 ciphers.
Line 22:		Line 22:
	https://www.openssl.org/docs/man1.0.2/apps/ciphers.html#CIPHER-LIST-FORMAT		https://www.openssl.org/docs/man1.0.2/apps/ciphers.html#CIPHER-LIST-FORMAT

			http://unix.stackexchange.com/questions/140601/verifying-a-ssl-certificates-fingerprint
			----
			http://serverfault.com/questions/216814/wireshark-display-filter-protocol-tlsv1-and-packetlength

			ssl.record.version == 0x0302

			That tells Wireshark to only display packets that are SSL conversations using TLS semantics.
	----		----
	http://blog.abarbanell.de/raspberry/2016/01/09/arduino-nginx/		http://blog.abarbanell.de/raspberry/2016/01/09/arduino-nginx/

Tim at 22:05, 20 January 2017

2017-01-20T22:05:04Z

@@ Line 2: / Line 2: @@
 ====refs====
 ----
 http://blog.abarbanell.de/raspberry/2016/01/09/arduino-nginx/

Tim: /* refs */

2017-01-20T21:50:44Z

refs

@@ Line 4: / Line 4: @@
 ----
 http://blog.abarbanell.de/raspberry/2016/01/09/arduino-nginx/
 ----
@@ Line 97: / Line 115: @@
 *http://iot-playground.com/2-uncategorised/40-esp8266-wifi-relay-switch-arduino-ide
 *[http://www.instructables.com/id/ESP8266-based-web-configurable-wifi-general-purpos-1/ web based configuration]
 ==== openssl ====

Tim: /* TLS on esp8266 */

2017-01-20T21:20:07Z

TLS on esp8266

← Older revision		Revision as of 17:20, 20 January 2017
Line 1:		Line 1:
	===TLS on esp8266 ===		===TLS on esp8266 ===

			====refs====
			----
			http://blog.abarbanell.de/raspberry/2016/01/09/arduino-nginx/
			----



	https://github.com/esp8266/Arduino/issues/2306		https://github.com/esp8266/Arduino/issues/2306

Tim: /* openssl */

2017-01-20T03:58:30Z

openssl

← Older revision		Revision as of 23:58, 19 January 2017
Line 111:		Line 111:
	View Certificate Entries		View Certificate Entries

	openssl x509 -text -noout -in ~~domain~~.crt		openssl x509 -text -noout -in fd.crt

	Verify a Certificate was Signed by a CA		Verify a Certificate was Signed by a CA
Line 125:		Line 125:
	openssl x509 -req -days 365 -in fd.csr -signkey fd.key -out fd.crt // create a cert w/o questions		openssl x509 -req -days 365 -in fd.csr -signkey fd.key -out fd.crt // create a cert w/o questions
	openssl x509 -text -in fd.crt -noout //view the cert		openssl x509 -text -in fd.crt -noout //view the cert
			openssl x509 -text -noout -in fd.crt -fingerprint //GET A CERTS FINGERPRINT
	Ciphers		Ciphers

Tim: /* TLS on esp8266 */

2017-01-20T03:33:31Z

TLS on esp8266

← Older revision		Revision as of 23:33, 19 January 2017
Line 136:		Line 136:
	This default cipher list can be replaced entirely using the --tls-cipher-list command line switch. For instance, the following makes ECDHE-RSA-AES128-GCM-SHA256:!RC4 the default TLS cipher suite:		This default cipher list can be replaced entirely using the --tls-cipher-list command line switch. For instance, the following makes ECDHE-RSA-AES128-GCM-SHA256:!RC4 the default TLS cipher suite:

	node --tls-cipher-list="~~ECDHE-RSA-AES128-GCM-SHA256~~:!RC4"		node --tls-cipher-list="TLS_RSA_WITH_AES_128_CBC_SHA:RC4-MD5"

Tim: /* openssl */

2017-01-20T03:28:17Z

openssl

← Older revision		Revision as of 23:28, 19 January 2017
Line 129:		Line 129:

	openssl ciphers -v 'ALL:COMPLEMENTOFALL' //list available		openssl ciphers -v 'ALL:COMPLEMENTOFALL' //list available

			====node ====
			mosca uses the node TLS stuff

			from https://nodejs.org/api/tls.html#tls_tls_ssl
			This default cipher list can be replaced entirely using the --tls-cipher-list command line switch. For instance, the following makes ECDHE-RSA-AES128-GCM-SHA256:!RC4 the default TLS cipher suite:

			node --tls-cipher-list="ECDHE-RSA-AES128-GCM-SHA256:!RC4"

Tim: /* TLS on esp8266 */

2017-01-20T03:24:18Z

TLS on esp8266

← Older revision		Revision as of 23:24, 19 January 2017
Line 1:		Line 1:
	===TLS on esp8266 ===		===TLS on esp8266 ===
			https://github.com/esp8266/Arduino/issues/2306

			As you see from the list, two cipher suites supported by axTLS library on the ESP side (TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_256_CBC_SHA) are not among the list of cipher suites supported by your server. This causes handshake failure, because if the server and client have no cipher suites in common, they can't talk to each other.

			now the above post shows the current library supports RC4-MD5 (I believe) - but I'm not sure how to prioritize it in the handshake? That is, until SHA256 is added :)

			https://github.com/esp8266/Arduino/issues/2201

			http://nodemcu.readthedocs.io/en/latest/en/modules/crypto/

			for nodemcu
			The crypto modules provides various functions for working with cryptographic algorithms.

			The following encryption/decryption algorithms/modes are supported: - "AES-ECB" for 128-bit AES in ECB mode (NOT recommended) - "AES-CBC" for 128-bit AES in CBC mode

			The following hash algorithms are supported: - MD2 (not available by default, has to be explicitly enabled in app/include/user_config.h) - MD5 - SHA1 - SHA256, SHA384, SHA512 (unless disabled in app/include/user_config.h)

			http://security.stackexchange.com/questions/105766/openssl-generate-self-signed-certificates-with-different-cipher-suites

			{"given_cipher_suites":["TLS_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_RC4_128_SHA","TLS_RSA_WITH_RC4_128_MD5"],"ephemeral_keys_supported":false,"session_ticket_supported":false,"tls_compression_supported":false,"unknown_cipher_suite_supported":false,"beast_vuln":false,"able_to_detect_n_minus_one_splitting":false,"insecure_cipher_suites":{"TLS_RSA_WITH_RC4_128_MD5":["use RC4 which has insecure biases in its output"],"TLS_RSA_WITH_RC4_128_SHA":["use RC4 which has insecure biases in its output"]},"tls_version":"TLS 1.1","rating":"Bad"}

			{"pid":5768,"hostname":"tim-hp","name":"mosca","level":40,"time":1484804098536,"msg":"101057795:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:openssl\\ssl\\s3_pkt.c:1472:SSL alert number 40\n","type":"Error","stack":"Error: 101057795:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:openssl\\ssl\\s3_pkt.c:1472:SSL alert number 40\n\n at Error (native)","client":"ESP8266Client-e1e","v":1}

			openssl s_client -connect sslvh.tm:8883 -tls1
			<pre>
			CONNECTED(00000003)
			depth=0 /C=US/ST=MA/L=Boston/O=sitebuilt.net/OU=dog/CN=sslvh.tm/emailAddress=mckenna.tim@gmail.com
			verify error:num=18:self signed certificate
			verify return:1
			depth=0 /C=US/ST=MA/L=Boston/O=sitebuilt.net/OU=dog/CN=sslvh.tm/emailAddress=mckenna.tim@gmail.com
			verify return:1
			---
			Certificate chain
			0 s:/C=US/ST=MA/L=Boston/O=sitebuilt.net/OU=dog/CN=sslvh.tm/emailAddress=mckenna.tim@gmail.com
			i:/C=US/ST=MA/L=Boston/O=sitebuilt.net/OU=dog/CN=sslvh.tm/emailAddress=mckenna.tim@gmail.com
			---
			Server certificate
			-----BEGIN CERTIFICATE-----
			MIIDkjCCAnoCCQDp7cwG8OKZBjANBgkqhkiG9w0BAQUFADCBijELMAkGA1UEBhMC
			VVMxCzAJBgNVBAgMAk1BMQ8wDQYDVQQHDAZCb3N0b24xFjAUBgNVBAoMDXNpdGVi
			dWlsdC5uZXQxDDAKBgNVBAsMA2RvZzERMA8GA1UEAwwIc3NsdmgudG0xJDAiBgkq
			hkiG9w0BCQEWFW1ja2VubmEudGltQGdtYWlsLmNvbTAeFw0xNzAxMTMyMjExMzla
			Fw0xODAxMTMyMjExMzlaMIGKMQswCQYDVQQGEwJVUzELMAkGA1UECAwCTUExDzAN
			BgNVBAcMBkJvc3RvbjEWMBQGA1UECgwNc2l0ZWJ1aWx0Lm5ldDEMMAoGA1UECwwD
			ZG9nMREwDwYDVQQDDAhzc2x2aC50bTEkMCIGCSqGSIb3DQEJARYVbWNrZW5uYS50
			aW1AZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtobF
			4ubgPP4bEQlhXCIMA7vwi7oqjJZ6qhp80tMdhvcI/Cjz/BsGKtxbiLlivcJozV67
			YOdidTS1CjH7vmxxxhIodF+g6LdoSJ75Sa2iRvCzbeGkrcNRL93jTkqQvYoG4GEz
			t5aBLnFnVDCr299d+VchOGv1Q3ChvLNxAU6TqMzhPoHKPH7DnGF9wSR9qvRP7rI+
			wq9+QeuLdQaQmUVnt80OZFp2Oq/9WGu5tiEie7JZcFqbNq2dFycIm2wa2/4mBJvA
			5Qcw6aV5C0Al870go0O6OSIODZ+RQg/KRunXXtFcSqdi8iuF6R2tzNbd5Vh2+ANK
			lTfStFJAH9IcXE/EVwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCmalVCojqvTHlE
			guDhoRX98FldiCpAI40ZWODiClQe7IR6ANPc8rqsMtfyfwIsYdXqcZzj5NBrIGp1
			SST7uVoA2YIy4eGs8AmKNKf4CkLEPM+7ST5mmpKtrUNmHrFjYUyn6C/iu8Vyx6lP
			MadCPezDB8qeCj5Z3ylYTLIBog1f29gkmqTCJtt7FIhFECSUGrYVMmyaScXONV5y
			UZSnGNoRWuqdcGu0a6PKBb270vpdUa2yPwFWwbMJxsCc/2sT7YQcAk++r6WFk1qF
			7AiNdZYsEgmjnkGGHRbjKTxk1Osh+G8uV3e6KzE/G5d0K80dIX8jLSPH6yYCYfe5
			msMayEMI
			-----END CERTIFICATE-----
			subject=/C=US/ST=MA/L=Boston/O=sitebuilt.net/OU=dog/CN=sslvh.tm/emailAddress=mckenna.tim@gmail.com
			issuer=/C=US/ST=MA/L=Boston/O=sitebuilt.net/OU=dog/CN=sslvh.tm/emailAddress=mckenna.tim@gmail.com
			---
			No client certificate CA names sent
			---
			SSL handshake has read 1080 bytes and written 412 bytes
			---
			New, TLSv1/SSLv3, Cipher is AES256-SHA
			Server public key is 2048 bit
			Compression: NONE
			Expansion: NONE
			SSL-Session:
			Protocol : TLSv1
			Cipher : AES256-SHA
			Session-ID: EB450D46B951B96AB6D8F3B10762772F05D8D9E65998FEC796EAA852A335FFD2
			Session-ID-ctx:
			Master-Key: 6F9AA7D47D1E352283BC6D7715A4664E184E4B565B14F6288350E117D3D9F6FD6869F28E66481822B1B37CC35E252BE0
			Key-Arg : None
			Start Time: 1484812097
			Timeout : 7200 (sec)
			Verify return code: 18 (self signed certificate)</pre>

			http://security.stackexchange.com/questions/119505/how-to-speed-up-slow-tls-handshake-on-esp8266-running-mbed-tls

			https://www.bountysource.com/issues/28368887-compatibility-with-arduino-and-esp8266

			http://superuser.com/questions/882638/sslciphersuite-settings-in-apache-for-supporting-tls-1-0-1-1-and-1-2

			*http://iot-playground.com/2-uncategorised/40-esp8266-wifi-relay-switch-arduino-ide
			*[http://www.instructables.com/id/ESP8266-based-web-configurable-wifi-general-purpos-1/ web based configuration]
	==== openssl ====		==== openssl ====