search

adafruit / nina-fw

Firmware for u-blox NINA W102 WiFi/BT module
85 stars 43 forks source link

Sectigo certificates not working with FW version 1.7.7 #66

Open Whisper380 opened 2 days ago

Whisper380 commented 2 days ago

As descriped on the following topic on the Adafruit CircuitPython forum: https://forums.adafruit.com/viewtopic.php?p=1036735#p1036735 I can not connect to my website anymore. The website is using the following certificates: Domain certificate: Sectigo ECC Domain Validation Secure Server CA Root certificate: USERTrust ECC Certification Authority The root certificates can be downloaded here: https://www.sectigo.com/knowledge-base/detail/Sectigo-Root-Certificates/kA03l000000c4KV

The website I want to connect with is the website from my tabel tennis club: ttvdiemeede.nl

The error i'm getting: Traceback (most recent call last): File "code.py", line 118, in <module> File "adafruit_requests.py", line 715, in get File "adafruit_requests.py", line 647, in request File "adafruit_connection_manager.py", line 337, in get_socket File "adafruit_connection_manager.py", line 249, in _get_connected_socket File "adafruit_connection_manager.py", line 61, in connect File "adafruit_esp32spi/adafruit_esp32spi_socketpool.py", line 114, in connect File "adafruit_esp32spi/adafruit_esp32spi.py", line 917, in socket_connect File "adafruit_esp32spi/adafruit_esp32spi.py", line 813, in socket_open File "adafruit_esp32spi/adafruit_esp32spi.py", line 430, in _send_command_get_response File "adafruit_esp32spi/adafruit_esp32spi.py", line 386, in _wait_response_cmd File "adafruit_esp32spi/adafruit_esp32spi.py", line 295, in _wait_for_ready TimeoutError: ESP32 not responding

Debug log: *** Get host by name *** Get socket Allocated socket #0 *** Socket connect mode 2 *** Open socket to ttvdiemeede.nl 443 2 *** Closing socket #0 Traceback (most recent call last): File "code.py", line 121, in <module> File "adafruit_requests.py", line 715, in get File "adafruit_requests.py", line 647, in request File "adafruit_connection_manager.py", line 337, in get_socket File "adafruit_connection_manager.py", line 249, in _get_connected_socket File "adafruit_connection_manager.py", line 61, in connect File "adafruit_esp32spi/adafruit_esp32spi_socketpool.py", line 114, in connect File "adafruit_esp32spi/adafruit_esp32spi.py", line 917, in socket_connect File "adafruit_esp32spi/adafruit_esp32spi.py", line 813, in socket_open File "adafruit_esp32spi/adafruit_esp32spi.py", line 430, in _send_command_get_response File "adafruit_esp32spi/adafruit_esp32spi.py", line 386, in _wait_response_cmd File "adafruit_esp32spi/adafruit_esp32spi.py", line 295, in _wait_for_ready TimeoutError: ESP32 not responding

Changing the website that HTTP is allowed is solving the issue, but then the site is not secure anymore and that is no option. Can you please look into this and fix this issue?

dhalbert commented 2 days ago

I believe this is functionally a dupe of #58.

The USERTRust root certificate is already included in https://github.com/adafruit/certificates/blob/cbb33c111f245411370c1e571012472323df3f07/data/roots.pem, used by NINA-NFW v1.7.7. However, the cert being used is an ECC (elliptic curve) certificate, and there is currently a bug that ECC certificate chains are not working. We originally saw this only with Let's Encrypt ECC roots (see #58), but now this is another example. There is some work ongoing that should fix this, #62, but it's been stalled for a while. I will check on that.