Esp32 Https Problem

Question

I am working on a project in which i have to send GET request to my Company's Https server. I have successfully sent the GET request using NodeMCU v 1.0 (ESP 12E). The NodeMCU 1.0 (ESP 12E) Arduino library uses SSL certificate Fingerprint ,host name and url to send the GET request. it is easy to find the fingerprint of Certificate using this website -> https://www.grc.com/fingerprints.htm

But in ESP 32 Arduino Library i have to pass the SSL certificate . I have no idea how to find the SSL certificate of my Company's website.

The format of the SSL certificate used in ESP 32 Arduino library is given below :

/*
const char* ca = \ 
"-----BEGIN CERTIFICATE-----\n" \  
"MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/\n" \  
"MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\n" \  
"DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow\n" \  
"SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT\n" \  
"GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC\n" \  
"AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF\n" \  
"q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8\n" \  
"SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0\n" \  
"Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA\n" \  
"a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj\n" \  
"/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T\n" \  
"AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG\n" \  
"CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv\n" \  
"bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k\n" \  
"c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw\n" \  
"VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC\n" \  
"ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz\n" \  
"MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu\n" \  
"Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF\n" \  
"AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo\n" \  
"uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/\n" \  
"wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu\n" \  
"X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG\n" \  
"PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6\n" \  
"KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==\n" \  
"-----END CERTIFICATE-----\n";
*/

Is there any easy way to find the SSL certificate of any website which uses Https instead of simple http ?

Thanks in advance

Answer 1

in chrome:

• press [F12]
• click the "Security" tab
• click the "View Certificate" button under "Security overview"
• click the "details" tab on the "Certificate" popup
• click the "Copy to File..." button
• click the "Next" button
• check the "base64 encoded x509" option
• click the "Next" button
• click the "Browse" button and choose a folder for the export
• enter a file name in the provided space
• click the "Next" button
• click the "Finish" button
• browse to the folder and open the export using a text editor

The export file has the same format, you just need to convert to a C literal usiing end-of-line slashes and quotes, an exercise i'll let you handle. There might be some fancy tool that does all this for you, I'd love to hear about one, but I know this is a fairly universal way to get it done.

Answer 2

Using e.g., openssl is possible. The command could go like this from the shell: openssl s_client -showcerts -servername www.theserver.io -connect www.theserver.io:443 -certform DER

Including >mycertif.der at the end of the command, you get the information in a file so you can cut-paste that part of the command output. Best,

Answer 3

Even if it's an old question... I suggest not rely on methods describe here. Of course you can get the SSL certificate from the browser and copy-paste it into your code. But each time the server will renews the certificate, the key change! If you have a "free" certificate, like the one from Let's Encrypt, used for example in all the shared hosting of all major web hosting companies, the key will change every... 3 months! So you'll have to update your ESP code each 3 months... For testing purpose, that's OK but for real "application" it's not a good option.

So,how can we do?

• Option 1: add a module on your web server, allowing to have a pre-defined SSL key. You just set the key for a specific folder and copy it to your ESP. My server is an Apache one and it seems this modules don't exist for Apache.

• Options 2: edit your Apache conf (commonly at etc/apache2/) for your serveur. In many cases, each time a customer access your server with http, Apache will change the call to https.
  This is made with a rewrite rule. You can change this like that:

    RewriteCond %{HTTPS} off
    RewriteCond %{THE_REQUEST} !/XXXXXX [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  
    RewriteCond %{HTTPS} on
    RewriteCond %{THE_REQUEST} /XXXXXX [NC]
    RewriteRule ^ http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  

where XXXX is the name fo the folder in which you will put the script called by your ESP. With that all folder on your site are using https except the one you use with your ESP. Of course this mean your ESP call is done using http and not https but in many cases we have to use ESP+https not for real security reason but because the web site is in https.