NetXDuo - Accepting an "untrusted" certificate

Question

NetXDuo - Accepting an "untrusted" certificate

FlavioB 1

Hi All,

I'm using the NetXDuo library to create a Mqtt Client on my embedded project.

The application works fine: the client designed using NetXDuo library is able to connect to a Mqtt broker both in plain mode and in secure mode (TLS).

In secure mode, It's needed to add the server's certificate to a trusted list (nx_secure_tls_trusted_certificate_add) in order to accept a remote certificate.

Below, my code:

  /* Initialize TLS module */  
  nx_secure_tls_initialize();  
  
  /* Create a TLS session */  
  ret = nx_secure_tls_session_create(TLS_session_ptr, &nx_crypto_tls_ciphers,crypto_metadata_client, sizeof(crypto_metadata_client));  
  if (ret != NX_SUCCESS)  
  {  
   for(;;) asm("NOP");  
  }  
  
  /* Need to allocate space for the certificate coming in from the broker. */  
  memset((certificate_ptr), 0, sizeof(NX_SECURE_X509_CERT));  
  
  ret = nx_secure_tls_session_time_function_set(TLS_session_ptr, nx_secure_tls_session_time_function);  
  
  if (ret != NX_SUCCESS)  
  {  
   for(;;) asm("NOP");  
  }  
  
  /* Allocate space for packet reassembly. */  
  ret = nx_secure_tls_session_packet_buffer_set(TLS_session_ptr, tls_packet_buffer,sizeof(tls_packet_buffer));  
  if (ret != NX_SUCCESS)  
  {  
   for(;;) asm("NOP");  
  }  
  
  /* allocate space for the certificate coming in from the remote host */  
  ret = nx_secure_tls_remote_certificate_allocate(TLS_session_ptr, certificate_ptr,tls_packet_buffer, sizeof(tls_packet_buffer));  
  if (ret != NX_SUCCESS)  
  {  
   for(;;) asm("NOP");  
  }  
  
  /* initialize Certificate to verify incoming server certificates. */  
  ret = nx_secure_x509_certificate_initialize(trusted_certificate_ptr, (UCHAR*)mosquitto_org_der,mosquitto_org_der_len, NX_NULL, 0, NULL, 0,NX_SECURE_X509_KEY_TYPE_NONE);  
  if (ret != NX_SUCCESS)  
  {  
    printf("Certificate issue..\nPlease make sure that your X509_certificate is valid. \n");  
    for(;;) asm("NOP");  
  }  
  
  /* Add a CA Certificate to our trusted store */  
  ret = nx_secure_tls_trusted_certificate_add(TLS_session_ptr, trusted_certificate_ptr);  
  if (ret != NX_SUCCESS)  
  {  
   for(;;) asm("NOP");  
  }

As written above, the code above works fine, but it's necessary to know (and load) the server's certificate beforehand and it's not always easy to have it.

So, my question is that: is it possible to accept a remote certificate without verification ?

Of course, it's a less secure mode, but in a few cases it may be the only possible solution !

Thanks a lot for your support !

FlavioB

AshokPeddakotla-MSFT 35,976 Reputation points Moderator

2022-08-05T11:16:46.173+00:00

@FlavioB AFAIK, A trusted certificate must be provided for TLS Client applications (unless X.509 authentication is disabled) or TLS will treat all certificates as untrusted and the handshake will fail.

So, my question is that: is it possible to accept a remote certificate without verification ?

Let me check if that supports or have any other way with our team and update you as earliest. Appreciate your time and patience.
FlavioB 1 Reputation point

2022-08-05T12:42:36.037+00:00

Thanks for your reply @AshokPeddakotla-MSFT

I know that is a unsecure mode, but a lot of mqtt clients have an option called "Certificate Validation" (or something like) that allow to accept only a "trusted" certificate (as NetXDuo) or otherwise accept any certification (unless it's not expired).

An option like that it's useful, because it's very complicated update a lot of embedded devices over the world if a remote mqtt broker changes its certification (because it's expired or for other reasons). Many customer don't have a necessary "technical background" to understand that.

Thanks again for your support.

FlavioB

1 answer

Your answer

AshokPeddakotla-MSFT 35,976 Reputation points Moderator

2022-08-05T11:16:46.173+00:00

@FlavioB AFAIK, A trusted certificate must be provided for TLS Client applications (unless X.509 authentication is disabled) or TLS will treat all certificates as untrusted and the handshake will fail.

So, my question is that: is it possible to accept a remote certificate without verification ?

Let me check if that supports or have any other way with our team and update you as earliest. Appreciate your time and patience.
FlavioB 1 Reputation point

2022-08-05T12:42:36.037+00:00

Thanks for your reply @AshokPeddakotla-MSFT

I know that is a unsecure mode, but a lot of mqtt clients have an option called "Certificate Validation" (or something like) that allow to accept only a "trusted" certificate (as NetXDuo) or otherwise accept any certification (unless it's not expired).

An option like that it's useful, because it's very complicated update a lot of embedded devices over the world if a remote mqtt broker changes its certification (because it's expired or for other reasons). Many customer don't have a necessary "technical background" to understand that.

Thanks again for your support.

FlavioB

Answer 1

Tiejun Zhou 1,131 Microsoft Employee

@FlavioB , do you plan to skip certificate validation in product or just for development? By skipping certificate validation, the TLS session can always be under MITM attack. Which means, it is literally same as plain session. To trust server's certificate, you only need to add the root CA which is always publicly available for cloud provider. When the root CA is about to expire, an OTA update should be used to renew it.

FlavioB 1 Reputation point

2022-08-30T14:46:00.367+00:00

Hi @Tiejun Zhou ,

Thanks for your reply and your explanation.

I agree with you that disabling certificate validation is a really bad idea. But this option - explicitly skipping the certificate validation – can be useful to test the connection parameters or for other critical needs.

As written above, the main mqtt clients have an option to skip the certificate validation and for my experience, the main SSL Connection Library (e.g: QT) can be ignored the certificate validation error.

It's not easy explain to my customers because my mqtt client can't be do that unlike the other commercial mqtt clients.

Thanks for your support !

Your Sincerely,

Flavio

Ps: Of course, avoid certificate validation is not a default and a recommended use !
Tiejun Zhou 1,131 Reputation points Microsoft Employee

2022-09-01T08:17:17.373+00:00

Thanks for sharing your use case! But NetX TLS does not support skipping the certification validation for now.

Share via

NetXDuo - Accepting an "untrusted" certificate

1 answer

Your answer