Build error while including SSL/TLS server certificate

[vipin das]

HI All,

I was trying to establish communication between my thread device and remote server using RPi and nRF5340DK. For that I took the echo client sample and modified according to my need. As an initial step, I tried to  ping from thread device to server, that was quite successful. 

Next I wanted to establish secure connection with the server and send/receive packets. For that I stored the server SSL certificate. But when I enable CONFIG_NET_SOCKETS_SOCKOPT_TLS=y, I get some build error while including the stored certificate as below.

In file included from /in3/test/qemu/zephyr-transport/src/ca_certificate.h:10,
                 from /in3/test/qemu/zephyr-transport/src/in3_https.c:17:
/in3/test/qemu/zephyr-transport/src/mainnet-ca-cert.der:1:6: error: 'BEGIN' undeclared here (not in a function)
    1 | -----BEGIN CERTIFICATE-----
      |      ^~~~~
/in3/test/qemu/zephyr-transport/src/mainnet-ca-cert.der:1:12: error: expected '}' before 'CERTIFICATE'
    1 | -----BEGIN CERTIFICATE-----
      |            ^~~~~~~~~~~
In file included from /in3/test/qemu/zephyr-transport/src/in3_https.c:17:
/in3/test/qemu/zephyr-transport/src/ca_certificate.h:9:47: note: to match this '{'
    9 | static const unsigned char ca_certificate[] = {
      |                                               ^
In file included from /in3/test/qemu/zephyr-transport/src/ca_certificate.h:10,
                 from /in3/test/qemu/zephyr-transport/src/in3_https.c:17:
/in3/test/qemu/zephyr-transport/src/mainnet-ca-cert.der:2:43: error: invalid suffix "XMA0GCSqGSIb3DQEBCwUA" on integer constant
    2 | MIIFTjCCBDagAwIBAgISBDR12TV11/ITTmCWq/qhU+6XMA0GCSqGSIb3DQEBCwUA

Could some one tell me why this error happening.

Regards

Vipin Das 

[Håkon Alseth]

Hi,

 

It looks like you haven't put quotes and newline in your certificate. Try to do that, similar to what is done here:

https://github.com/nrfconnect/sdk-nrf/blob/main/samples/nrf9160/https_client/cert/DigiCertGlobalRootCA.pem

 

Kind regards,

Håkon

[vipin das]

Thanks Håkon for your reply. Is there any command I can use to create the certificate in this way. Otherwise I should manually add the quotes and newline. 

I used the below command to create the certificate file for the server. 

openssl s_client -showcerts -connect mainnet.incubed.net:443 -servername mainnet.incubed.net  </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mainnet-ca-cert.der

Regards

Vipin Das