search

gilmaimon / ArduinoWebsockets

A library for writing modern websockets applications with Arduino (ESP8266 and ESP32)
GNU General Public License v3.0
482 stars 97 forks source link

Unable to connect to secure websocket server (wss) with ESP32 #99

Open dante-ventura opened 3 years ago

dante-ventura commented 3 years ago

Describe the bug When using the Secured-Esp32-Client.ino example file, the websocket client fails to connect and logs this: '[E][WiFiClient.cpp:309] setOption(): fail on fd -1, errno: 9, "Bad file number"'

I tried with and without the certificate and also tried my own https site created through Azure still without success. With a non-secure websocket (ws://), everything works as expected.

To Reproduce Version: 0.5.0 Board: KeeYees ESP32 with ESP-WROOM-32 chip

Expected behavior Expected websocket client to successfully connect to the server.

Code Secured-Esp32-Client.ino with client.setCACert(echo_org_ssl_ca_cert); removed.

adelin-mcbsoft commented 3 years ago

Hi,

I'm afraid the reason why you can't connect is not related to the mentioned error (e.g. Bad File Number). That's an error I see all the time, not sure what is related to but I was able to connect and work with the library while having (and ignoring) it.

The reason I think you're not able to connect is exactly this:

Code Secured-Esp32-Client.ino with client.setCACert(echo_org_ssl_ca_cert); removed.

You are removing the Certificate Authority method call, therefore ESP32 cannot verify the host server. Unlike your browser, ESP32 does not come with a list of CA issuers included.

Therefore, you have to specify using the client.setCACert() method, the root certificate by which the host has signed its certificate with. (in case of wss://echo.websocket.org/ it uses the Let's Encrypt R3 certificate, which you can find here ). While using your own server, you'll have to check and see which root CA SSL certificate you are using and write it accordingly.

_Side note: By default, in ESP32's ESP-IDF mbedTLS is compiled without date/time support so the device doesn't check the expiry of certificates at the device end nor any OCSP, but only its chain of trust._

I personally tested the code from the example and it works as expected. Fix the issue, try again and come back with a reply.

Thanks, A.

gilmaimon commented 3 years ago

You are my hero @adelin-mcbsoft, thank you so much for helping!