Using SHA256 certificate hasing

RE: Using SHA256 certificate hasing

Elfving — Thu, 03 Jul 2025 07:36:36 GMT

Hi again Tudor 🙂

So this problem is something that is a bit beyond what we would typically provide support with. It is not really an optimization supported by Mbed TLS nor Zephyr nor otherwise in NCS. You would of course be free to hack another solution, but it would be outside of the code we provide/support.

Zephyr has this TLS credentials module to handle certs, this takes full cert and as already pointed would need a lot of memory, but if we are talking about taking a shortcut to store only fingerprints (like eg. ESP is providing), this does sound like an idea.

That being said, I am trying to ask around if anyone has any feedback on the methodology you explain here.

Regards,

Elfving

RE: Using SHA256 certificate hasing

Tudor B. — Sat, 28 Jun 2025 18:42:09 GMT

It's not burning, but it would be great if we can get it done by the end of next week so that we don't leave it like that for too long and forget what we were doing. :))

RE: Using SHA256 certificate hasing

Elfving — Thu, 26 Jun 2025 14:23:36 GMT

Hi Tudor,

I'll have to get back to you on this tomorrow or later this week - my go-to expert on this is currently a bit busy. Let me know if this is too urgent for that.

Regards,

Elfving

RE: Using SHA256 certificate hasing

Emil Lenngren — Thu, 26 Jun 2025 07:25:44 GMT

Did you consider that most servers don't include a copy of the root certificate in the certificate chain they send? With only a fingerprint, you won't be able to verify the signature in the last certificate in the sent chain, if I'm not mistaken.

You should instead create a minium binary file containing a sorted list of root certificates having the lookup key set to the subject name (in DER format). A hash of this could maybe also work. It's enough if the value contains the raw public key and type (rsa, secp256r1 or secp384r1).

Espressif uses this approach in their sdk: see docs.espressif.com/.../esp_crt_bundle.html and github.com/.../gen_crt_bundle.py.