Questions about HTTPS

[JaZzHT9]

Hi,
I'm having a problem with the "ulfius_start_secure_ca_trust_framework function": "Ulfius - Error MHD_start_daemon, aborting". As a novice, I tried many methods, but none of them worked. Although this may be more of a MicroHTTPD problem, I really have no way out and hope you can give some suggestions.

[babelouest]

Hello,

I don't know why you have this error, since you didn't post a sample code, but the function ulfius_start_secure_ca_trust_framework is supposed to be used for a client TLS certificate authentication.

If you only need https, you should use instead ulfius_start_secure_framework which only expects the server key and certificate.

You have several resources on this project to help you:

• API documentation
• The simple example program has an option to use https

Hope that will help you.

[JaZzHT9]

Thank you very much for your careful reply. Actually I have tried with ulfius_start_secure_framework and it's still the same problem, but I'm almost sure it's a microhttpd problem.

In addition, I would like to ask you a few questions:

1 Does the parameters passed in to function ulfius_start_secure_framework affect the running of the program? As far as I know, private keys and certificates are available in multiple file formats, such as pem, key, crt... Will the format of these files make a difference?Is there anything I should pay attention to?

2 The ulfius_start_secure_ca_trust_framework function is just used to verify the client's certificate, so the private key is passed in is the client's own?

Looking forward to your reply

[babelouest]

In the function ulfius_start_secure_framework, the parameters const char * key_pem and const char * cert_pem must be on X509 PEM format,

With openssl for example, you can run the following command to generate a self-signed key/certificate pair using X509 PEM format:

$ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365

and then use the content of the files key.pem and cert.pem as the ulfius_start_secure_framework parameters const char * key_pem and const char * cert_pem.

Something like:

const char key_pem[] = "-----BEGIN PRIVATE KEY-----\n"
"MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDC2kwAziXUf33m\n"
"iqWp0yG6o259+nj7hpQLC4UT0Hmz0wmvreDJ/yNbSgOvsxvVdvzL2IaRZ+Gi5mo0\n"
"lswWvL6IGz7PZO0kXTq9sdBnNqMOx27HddV9e/2/p0MgibJTbgywY2Sk23QYhJpq\n"
//...

const char cert_pem[] = "-----BEGIN CERTIFICATE-----\n"
MIIH/TCCBeWgAwIBAgIQaBYE3/M08XHYCnNVmcFBcjANBgkqhkiG9w0BAQsFADBy\n"
MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x\n"
ETAPBgNVBAoMCFNTTCBDb3JwMS4wLAYDVQQDDCVTU0wuY29tIEVWIFNTTCBJbnRl\n"
// ...
ulfius_start_secure_framework(&instance, key_pem, cert_pem)

The last parameter in the function ulfius_start_secure_ca_trust_framework is the const char * root_ca_pem, which is the CA root certificate that must be used to validate the certificate chain starting from the client certificate up to the CA root certificate. Not the CA private key, nor the client's private key are known by ulfius or the connection chain. If you're interested with this mechanic, I suggest you read online documentation on TLS client certificate.

[JaZzHT9]

Thank you very much for your careful and detailed reply！