Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit d945078

Browse files
Fix wrong scrape of Root Certificates (#216)
* Correctly lookup for RootCA * update docs * Scrape all possible root certificate In the uno r4 we're using mbedtls which has a strange behaviour. And some root certificates won't work. Therfore the most simple solution is using all the possible ones, found during the handshake.
1 parent f07445f commit d945078

File tree

4 files changed

+30
-16
lines changed

4 files changed

+30
-16
lines changed

‎certificates/certutils.go‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ import (
3030

3131
// ScrapeRootCertificatesFromURL downloads from a webserver the root certificate
3232
// required to connect to that server from the TLS handshake response.
33-
func ScrapeRootCertificatesFromURL(URL string) (*x509.Certificate, error) {
33+
func ScrapeRootCertificatesFromURL(URL string) ([]*x509.Certificate, error) {
3434
conn, err := tls.Dial("tcp", URL, &tls.Config{
3535
InsecureSkipVerify: false,
3636
})
@@ -45,15 +45,16 @@ func ScrapeRootCertificatesFromURL(URL string) (*x509.Certificate, error) {
4545
return nil, err
4646
}
4747

48-
peerCertificates := conn.ConnectionState().PeerCertificates
49-
if len(peerCertificates) == 0 {
50-
err = fmt.Errorf("no peer certificates found at %s", URL)
51-
logrus.Error(err)
52-
return nil, err
48+
chains := conn.ConnectionState().VerifiedChains
49+
if len(chains) == 0 {
50+
return nil, fmt.Errorf("no certificates found at %s", URL)
5351
}
54-
55-
rootCertificate := peerCertificates[len(peerCertificates)-1]
56-
return rootCertificate, nil
52+
rootCertificates := make([]*x509.Certificate, len(chains))
53+
for i, chain := range chains {
54+
// The last certificate of the chain is always the Root Certificate
55+
rootCertificates[i] = chain[len(chain)-1]
56+
}
57+
return rootCertificates, nil
5758
}
5859

5960
// LoadCertificatesFromFile read certificates from the given file. PEM and CER formats

‎certificates/certutils_test.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package certificates_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/arduino/arduino-fwuploader/certificates"
7+
"github.com/stretchr/testify/require"
8+
)
9+
10+
func TestScrapeRootCertificatesFromURL(t *testing.T) {
11+
rootCerts, err := certificates.ScrapeRootCertificatesFromURL("www.arduino.cc:443")
12+
require.NoError(t, err)
13+
for _, cert := range rootCerts {
14+
require.Equal(t, cert.Issuer, cert.Subject)
15+
}
16+
}

‎cli/certificates/flash.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,11 +121,11 @@ func flashCertificates(uploader *plugin.FwUploader, certificateURLs, certificate
121121
for _, URL := range certificateURLs {
122122
logrus.Infof("Converting and flashing certificate from %s", URL)
123123
stdout.Write([]byte(fmt.Sprintf("Converting and flashing certificate from %s\n", URL)))
124-
rootCert, err := certificates.ScrapeRootCertificatesFromURL(URL)
124+
rootCerts, err := certificates.ScrapeRootCertificatesFromURL(URL)
125125
if err != nil {
126126
return nil, err
127127
}
128-
allCerts = append(allCerts, rootCert)
128+
allCerts = append(allCerts, rootCerts...)
129129
}
130130

131131
f, err := certsBundle.Create()

‎docs/plugins.md‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -94,11 +94,8 @@ Error: reboot mode: upload commands sketch: setting DTR to OFF
9494
9595
#### I flashed the certificates, but I am unable to reach the host
9696
97-
The **whole certificate chain** is needed to make it work. Using
98-
[`-u` flags](commands/arduino-fwuploader_certificates_flash.md#options) (ex: `-u www.arduino.cc:443`) won’t work because
99-
it only downloads the root certificates. The solution is to use only the
100-
[`-f` flag](commands/arduino-fwuploader_certificates_flash.md#options) and provide a pem certificate containing the
101-
whole chain.
97+
There was a bug in the arduino-fwuploader prior `2.4.1` which didn't pick the actual root certificate. Upgrading to the
98+
latest version solves the problem.
10299

103100
#### My antivirus says that `espflash` is a threat
104101

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /