search

Links2004 / arduinoWebSockets

arduinoWebSockets
GNU Lesser General Public License v2.1
1.87k stars 553 forks source link

SSL without CA or fingerprint not working #492

Closed qnten closed 3 years ago

qnten commented 4 years ago

Im using this function to connect to my server: webSocket.beginSSL("websocket.example.com", 443, "/led");, and I had the same error as described in https://github.com/Links2004/arduinoWebSockets/issues/428.

It only worked after I added this else { _client.ssl->setInsecure(); } to line 176.

https://github.com/Links2004/arduinoWebSockets/blob/c038f100d68b8e5d0a96f25dd1609ff28592b02f/src/WebSocketsClient.cpp#L167-L176

Am I using the wrong method to connect or is this a bug?

sebastien-savalle commented 4 years ago

I had the same issue. Empty fingerprint is not working as expected.

You could submit a pull request with your change ?

sovcik commented 4 years ago

I think the problem is self-signed certificate.

If you use setInsecure it will skip certificate verification completely. If you do not provide certificate (ESP32) or fingerprint (ESP8266) it works just fine even now.

I do not this change is a good idea.

sovcik commented 4 years ago

If you want to use self-signed certificate, then you should provide host's certificate or fingerprint while using WSS.

ahmad7091 commented 4 years ago

I also had this problem, but nobody said is this a right way to solve the problem?

ziolelle commented 4 years ago

It seems that the problem is out again, with or without using the fingerprint in the call beginSSL, the connection won't work.

Only using the workaround of @qnten I successfully connected to a wss server (i.e. wss://echo.websocket.org)

Is it due to new standard concerning usage of WiFiClientSecureBearSSL lib ? The compilation gives two warning concerning usage of deprecated functions: _client.ssl->setCACert at line 173 and _client.ssl->verify at line 761 in file WebSocketsClient.cpp

BR Daniele