Skip to content

Commit 09eb519

Browse files
aentingeraentinger
authored
Merge pull request #71 from arduino/new-cert-list
Add new certificate list and instructions on how to build it.
2 parents 9b4c435 + a33dc6d commit 09eb519

File tree

8 files changed

+2754
-835
lines changed

8 files changed

+2754
-835
lines changed

‎README.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,21 @@ If updating **Arduino UNO WiFi Rev. 2** NINA firmware via [SerialNINAPassthrough
1919
+ --baud 115200 --before no_reset
2020
```
2121

22+
## Build a new certificate list (based on the Google Android root CA list)
23+
```bash
24+
git clone https://android.googlesource.com/platform/system/ca-certificates
25+
cp nina-fw/tools/nina-fw-create-roots.sh ca-certificates/files
26+
cd ca-certificates/files
27+
./nina-fw-create-roots.sh
28+
cp roots.pem ../../nina-fw/data/roots.pem
29+
```
30+
31+
## Check certificate list against URL list
32+
```bash
33+
cd tools
34+
./sslcheck.sh -c ../data/roots.pem -l url_lists/url_list_moz.com.txt -e
35+
```
36+
2237
## License
2338

2439
Copyright (c) 2018-2019 Arduino SA. All rights reserved.

‎data/roots.pem

Lines changed: 648 additions & 834 deletions
Large diffs are not rendered by default.

‎main/CommandHandler.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636

3737
#include "esp_log.h"
3838

39-
const char FIRMWARE_VERSION[6] = "1.4.5";
39+
const char FIRMWARE_VERSION[6] = "1.4.6";
4040

4141
/*IPAddress*/uint32_t resolvedHostname;
4242

‎tools/nina-fw-create-roots.sh

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/bin/bash
2+
echo '' > roots.pem
3+
4+
for filename in *.0
5+
do
6+
7+
is_amazon=$(openssl x509 -in $filename -text -nocert | grep "O = Amazon")
8+
is_google=$(openssl x509 -in $filename -text -nocert | grep "O = Google Trust Services LLC")
9+
is_comodo=$(openssl x509 -in $filename -text -nocert | grep "O = Comodo CA Limited")
10+
is_comodo_uppercase=$(openssl x509 -in $filename -text -nocert | grep "O = COMODO CA Limited")
11+
is_digicert=$(openssl x509 -in $filename -text -nocert | grep "O = DigiCert")
12+
is_isrg=$(openssl x509 -in $filename -text -nocert | grep "O = Internet Security Research Group")
13+
is_verisign=$(openssl x509 -in $filename -text -nocert | grep "O = \"VeriSign, Inc.\"")
14+
is_baltimore=$(openssl x509 -in $filename -text -nocert | grep "O = Baltimore")
15+
is_globalsign=$(openssl x509 -in $filename -text -nocert | grep "O = GlobalSign")
16+
is_starfield=$(openssl x509 -in $filename -text -nocert | grep "O = \"Starfield Technologies, Inc.\"")
17+
is_dst=$(openssl x509 -in $filename -text -nocert | grep "O = Digital Signature Trust Co.")
18+
is_cybertrust=$(openssl x509 -in $filename -text -nocert | grep "O = \"Cybertrust, Inc\"")
19+
is_usertrust=$(openssl x509 -in $filename -text -nocert | grep "O = The USERTRUST Network")
20+
21+
openssl_opts="-text -certopt no_header,no_pubkey,no_subject,no_issuer,no_signame,no_version,no_serial,no_validity,no_extensions,no_sigdump,no_aux,no_extensions"
22+
23+
if [ ! -z "$is_amazon" ]
24+
then
25+
echo $is_amazon
26+
openssl x509 -in $filename $openssl_opts >> roots.pem
27+
fi
28+
29+
if [ ! -z "$is_google" ]
30+
then
31+
echo $is_google
32+
openssl x509 -in $filename $openssl_opts >> roots.pem
33+
fi
34+
35+
if [ ! -z "$is_comodo_uppercase" ]
36+
then
37+
echo $is_comodo_uppercase
38+
openssl x509 -in $filename $openssl_opts >> roots.pem
39+
fi
40+
41+
if [ ! -z "$is_comodo" ]
42+
then
43+
echo $is_comodo
44+
openssl x509 -in $filename $openssl_opts >> roots.pem
45+
fi
46+
47+
if [ ! -z "$is_digicert" ]
48+
then
49+
echo $is_digicert
50+
openssl x509 -in $filename $openssl_opts >> roots.pem
51+
fi
52+
53+
if [ ! -z "$is_isrg" ]
54+
then
55+
echo $is_isrg
56+
openssl x509 -in $filename $openssl_opts >> roots.pem
57+
fi
58+
59+
if [ ! -z "$is_verisign" ]
60+
then
61+
echo $is_verisign
62+
openssl x509 -in $filename $openssl_opts >> roots.pem
63+
fi
64+
65+
if [ ! -z "$is_baltimore" ]
66+
then
67+
echo $is_baltimore
68+
openssl x509 -in $filename $openssl_opts >> roots.pem
69+
fi
70+
71+
if [ ! -z "$is_globalsign" ]
72+
then
73+
echo $is_globalsign
74+
openssl x509 -in $filename $openssl_opts >> roots.pem
75+
fi
76+
77+
if [ ! -z "$is_starfield" ]
78+
then
79+
echo $is_starfield
80+
openssl x509 -in $filename $openssl_opts >> roots.pem
81+
fi
82+
83+
if [ ! -z "$is_dst" ]
84+
then
85+
echo $is_dst
86+
openssl x509 -in $filename $openssl_opts >> roots.pem
87+
fi
88+
89+
if [ ! -z "$is_cybertrust" ]
90+
then
91+
echo $is_cybertrust
92+
openssl x509 -in $filename $openssl_opts >> roots.pem
93+
fi
94+
95+
if [ ! -z "$is_usertrust" ]
96+
then
97+
echo $is_usertrust
98+
openssl x509 -in $filename $openssl_opts >> roots.pem
99+
fi
100+
101+
done

‎tools/sslcheck.sh

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/bash
2+
3+
while getopts "c:l:e" opt;do
4+
case $opt in
5+
c ) export CER_FILE="$OPTARG";;
6+
l ) export URL_LIST="$OPTARG";;
7+
e ) export SHOW_ERR=1;;
8+
* )
9+
echo "Unknown parameter."
10+
exit 1
11+
;;
12+
esac
13+
done
14+
15+
if [ $# -eq 0 ] ; then
16+
echo "Usage: $(basename $0) [-c /path/to/certificate/file.pem] [-l path/to/url/list.txt]"
17+
echo
18+
echo " -c specify certificate file to test"
19+
echo " -l specify url list"
20+
echo " -e show curl errors in log"
21+
echo
22+
echo "Example:"
23+
echo " $(basename $0) -c roots.pem -l url_list.txt"
24+
exit 0
25+
fi
26+
27+
export SHOW_ERR=${SHOW_ERR:-0}
28+
29+
echo
30+
echo SHOW_ERR=$SHOW_ERR
31+
echo
32+
33+
for i in $(cat $URL_LIST)
34+
do
35+
echo -n "$i "
36+
# -s: silent
37+
# -S: show error
38+
# -m: max time
39+
# --cacert: path to certificate pem file
40+
# --capath: local certificate path
41+
# --output: stdout output
42+
if [ "$SHOW_ERR" -eq 1 ] ; then
43+
m=$(curl "$i" -s -S -m 60 --cacert $CER_FILE --capath /dev/null --output /dev/null --stderr -)
44+
else
45+
curl "$i" -s -m 60 --cacert $CER_FILE --capath /dev/null --output /dev/null
46+
fi
47+
#curl --cacert roots.pem --trace-ascii log.log -K url_list.txt
48+
if [ $? -eq 0 ] ; then
49+
echo -e "\e[32m PASS \e[39m"
50+
else
51+
echo -n -e "\e[31m FAIL \e[39m"
52+
echo $m
53+
fi
54+
done

0 commit comments

Comments
 (0)