Moving to TLS from OpenSSL in Arduino environment?

[SteveWeingart]

Hi,

I've been building a webserver for a device using the compat version of the esp32_https_server and I'm getting the following warnings:

In file included from C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src\ConnectionContext.hpp:9,
from C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src\WebsocketHandler.hpp:14,
from C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src\WebsocketNode.hpp:7,
from C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src\WebsocketNode.cpp:1:
C:\Users\steve\Documents\ArduinoData\packages\esp32\hardware\esp32\2.0.2/tools/sdk/esp32/include/openssl/include/openssl/ssl.h:8:2: warning: #warning "OpenSSL component will be removed from ESP-IDF in v5.0, please use esp_tls instead" [-Wcpp]
#warning "OpenSSL component will be removed from ESP-IDF in v5.0, please use esp_tls instead"

So I did some hunting and changed the appropriate files (HTTPConnection.hpp, ConnectionContext.hpp, HTTPSServer.hpp, HTTPResponse.hpp), from #include "openssl/ssl.h" to #include "mbedtls/md.h" That almost works. I get the following errors:

In file included from C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src/HTTPSServer.hpp:24,
from C:\Users\steve\Documents\Arduino\libraries\esp32_https_server_compat\src\ESPWebServerSecure.hpp:5,
from C:\Users\steve\Documents\Arduino\libraries\esp32_https_server_compat\src\ESPWebServerSecure.cpp:1:
C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src/HTTPSConnection.hpp:39:46: error: 'SSL_CTX' has not been declared
virtual int initialize(int serverSocketID, SSL_CTX * sslCtx, HTTPHeaders *defaultHeaders);
^~~~~~~
C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src/HTTPSConnection.hpp:54:3: error: 'SSL' does not name a type; did you mean 'SS'?
SSL * _ssl;
^~~
SS
In file included from C:\Users\steve\Documents\Arduino\libraries\esp32_https_server_compat\src\ESPWebServerSecure.hpp:5,
from C:\Users\steve\Documents\Arduino\libraries\esp32_https_server_compat\src\ESPWebServerSecure.cpp:1:
C:\Users\steve\Documents\Arduino\libraries\ESP32_HTTPS_Server\src/HTTPSServer.hpp:43:3: error: 'SSL_CTX' does not name a type; did you mean 'SHA_CTX'?
SSL_CTX * _sslctx;
^~~~~~~
SHA_CTX

I also got a warning about #include <hwcrypto/sha.h> being deprecated, but swapping to #include < sha_parallel_engine.h> worked fine.

Any ideas?

Thanks!

Steve

[KirinDenis]

Did someone manage to partition for new versions or is there a fork?

[KirinDenis]

https://github.com/stooged/esp32_https_server it works fine and update the old SHA

BTW how generate the CERT:
genrsa -out key.txt 512
rsa -in key.txt -out key.txt
req -sha256 -new -things -key key.txt -out cert.csr -subj '/C=UA/ST=K/L=Kiev/O=yourcompanyname [RO]/OU=OWLOS/CN=OWLOS.local' -addext subjectAltName=DNS:OWLOS.local,IP:192.168.4.1
x509 -req -sha256 -days 365 -in cert.csr -signkey key.txt -out cert.txt

genrsa -out key.txt 512
rsa -in key.txt -out key.txt
req -sha256 -new -things -key key.txt -out cert.csr -subj '/C=UA/ST=K/L=Kiev/O=yourcompanyname [RO]/OU=OWLOS/CN=OWLOS.local' -addext subjectAltName=DNS:OWLOS.local,IP:192.168.4.1
x509 -req -sha256 -days 365 -in cert.csr -signkey key.txt -out cert.txt

^^^
Copy to OpenSSL command prompt, the cert.txt and key.txt files will be created
https://slproweb.com/products/Win32OpenSSL.html
^^^
Install OpenSLL for Windows
Documentation: https://www.onetransistor.eu/2019/04/https-server-on-esp8266-thingmcu.html

-subj:
C - country, short name
ST - state or province
L - locality or city
O - organization
OU - organizational thing
CN - common name (domain name)

The subjectAltName parameter must contain the domain name(s) where your server is accessible. It can specify also IP addresses like this: subjectAltName=DNS:esp8266.local,IP=192.168.4.1. When requesting a webpage secured with this certificate, the browser will complain it does not know the CA ("ERR_CERT_AUTHORITY_INVALID" is the message displayed by Google Chrome).