WifiClientSecure has no verify method

[salqadri]

I'm porting some esp8266 code and discovered that the ESP32 version of the WiFiClientSecure class does not seem to have any methods to help verify any certs or fingerprints. Is this something that is on the roadmap?

[copercini]

SHA1 fingerprint is broken now: https://shattered.io/

You can use the entire CA certificate to verify. How to do that?

Open your target site (I will use https://www.howsmyssl.com/ for example...)

See the certificates

Download the CA certificate

Open in your favorite text editor, format and put in your arduino sketch

[terryjmyers]

Should we incorporate a SHA-3 512 library as a standard: https://github.com/DuSTman31/SHA-3

[zenmanenergy]

It appears to be in the esp8266 version. https://github.com/esp8266/Arduino/blob/master/libraries/ESP8266WiFi/src/WiFiClientSecure.cpp#L517

Is there a reason the same code cannot be used?

[copercini]

@zenmanenergy All the SSL core was changed from ESP8266 (AxTLS) to ESP32 (MbedTLS), there is a lot of new features, and SHA1 fingerprinting was deprecated due security reasons (explanation here ) for now there is no fingerprinting support, but something with SHA256 or similar can be done in the future...
For now it supports certificates verification (like browsers do)

[vupqtran]

Hi @copercini
Can i use 1 CA Certificate for more esp32? Or can i get CA certificate with esp not using web browser?
Thanks a lot.

[copercini]

@vupqtran yes, since CA is public, you can use the same in a lot of browsers and ESPs (not confuse CA with client certificates, which are unique for each device)

The idea of having a CA is to verify the server identity, if you are talking with your real server and not a fake one. So get it "on the fly" is not the best idea since you can download a fake certificate that verifies a fake server...