Use MbedTLS to read the certificate authority of the client

Viewed 25

I'm using MbedTLS v3.1 on an MCU as a server, and I have configured a PKI self-signed with a Root CA, two sub-ca's and a leaf certificate. The server is configured with a certificate chain with the two sub-ca's and the leaf cert. The client for testing, made with Node.js, uses the Root CA.

This is an example of the client, simplified:

var options = {
    ca: fs.readFileSync('pe_certs/RootCACert.pem'),
    rejectUnauthorized: true,
};

var client = tls.connect(PORT, HOST, options, () => {
    console.log('Connected to %s on %s', HOST, PORT)
    client.write("...")
});

The private key and certificate chain on the server is loaded as follows:

// SERVER_CRT is a string with a chain of three certs in PEM
// two sub-ca's and the leaf cert
int ccs_mbedtls_load_certs()
{
    int ret = 0;

    ret = mbedtls_x509_crt_parse( &tls_lv.cacert, SERVER_CRT, SERVER_CRT_len );
    if ( ret == RET_SUCCESS )
    {
        ret = mbedtls_pk_parse_key( &tls_lv.pkey, (const unsigned char *) 
                                  SERVER_KEY, SERVER_KEY_len,
                                  (const unsigned char *) SERVER_KEY_PWD, 
                                  SERVER_KEY_PWD_LEN,
                                  dummy_random, NULL );
    }

    return ret;
}

The communication is working well, I can connect from the client and transmit data to the server. Wireshark is showing a good trace.

The situation is that sometimes I can find a client that uses a different Root CA than the one used to generate my two sub-ca's, so in this case the communication could not be carried out (the client rejects it).

Is there any way for the server to extract information from the client's CA_CERT? Knowing the issuer, subject name… etc.?

I'm playing with the object ssl.session (mbedtls_ssl_context) after the handshake, but I can not find any useful information there.

0 Answers
Related