TLS client implementation

test/certs/ca.crt

@@ -0,0 +1,8 @@
+-----BEGIN CERTIFICATE-----
+MIIBFTCBvAIJAJiASLWtAz5MMAoGCCqGSM49BAMCMBMxETAPBgNVBAMMCE1vbmdv
+b3NlMB4XDTI0MDMyNTExNTU0NVoXDTM0MDMyMzExNTU0NVowEzERMA8GA1UEAwwI
+TW9uZ29vc2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARaohnchUT4QTRIYKBX
+1k0n3/PDwpXwiPyJIb+Wwfsmx0Y74KU7xGZLHK2C1PmIADVnTf3z304E97AXM+WV
+3gkOMAoGCCqGSM49BAMCA0gAMEUCIQDJ0GYwCwucIKl+K/zRgptW6HVxD5y6+hu4
+YBP9j+vwCAIgWJswYluq0szGxmfKnSXyTDioA1XrDhCVjYGO61U60Gk=
+-----END CERTIFICATE-----

test/certs/ca.key

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIHtFV1AGKDqJRVBg3hQEmkHQDlXxCDFpIJ4b7UUyUtHRoAoGCCqGSM49
+AwEHoUQDQgAEWqIZ3IVE+EE0SGCgV9ZNJ9/zw8KV8Ij8iSG/lsH7JsdGO+ClO8Rm
+SxytgtT5iAA1Z039899OBPewFzPlld4JDg==
+-----END EC PRIVATE KEY-----

test/certs/ca.srl

@@ -0,0 +1 @@
+96EAA481EB95FF30

test/certs/client.crt

@@ -0,0 +1,9 @@
+-----BEGIN CERTIFICATE-----
+MIIBLTCB1KADAgECAgkAluqkgeuV/zAwCgYIKoZIzj0EAwIwEzERMA8GA1UEAwwI
+TW9uZ29vc2UwHhcNMjQwMzI1MTE1NTQ1WhcNMjQwNDI0MTE1NTQ1WjAMMQowCAYD
+VQQDDAFjMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoyB/9kTJJnPLlLFrQmME
+6LMvCpjp05MuSTOvEmXqfWH+eC2e0bb6h7YIW+lcOrVQhDEt6xKFs1rqKUR0lgou
+/6MYMBYwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMCA0gAMEUCIQDy
+11QWTyWuTq6avrsVi4lWfjMQSm14RxtyYUiStaahnwIgcXrf5MeOlupWLxPqEZTz
+uOejUi45wZ6m3S1BLa31g3Y=
+-----END CERTIFICATE-----

test/certs/client.csr

@@ -0,0 +1,7 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIHGMG4CAQAwDDEKMAgGA1UEAwwBYzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
+BKMgf/ZEySZzy5Sxa0JjBOizLwqY6dOTLkkzrxJl6n1h/ngtntG2+oe2CFvpXDq1
+UIQxLesShbNa6ilEdJYKLv+gADAKBggqhkjOPQQDAgNIADBFAiBDSG3wDIJaEn5c
+PU+4WLGJ8+nzTewHGtpQELOXWURxLQIhAP5BocCQyrGW/5dEc/VWMgqH2eznZJcT
+ftb9Tk6I6Pjx
+-----END CERTIFICATE REQUEST-----

test/certs/client.key

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIPEthf+Qq9dXJBxSZuYr2WhgzuhrDfMaD1kQzeKHZFfDoAoGCCqGSM49
+AwEHoUQDQgAEoyB/9kTJJnPLlLFrQmME6LMvCpjp05MuSTOvEmXqfWH+eC2e0bb6
+h7YIW+lcOrVQhDEt6xKFs1rqKUR0lgou/w==
+-----END EC PRIVATE KEY-----

test/certs/generate.sh

@@ -0,0 +1,36 @@
+#/bin/sh
+#
+# Geneate self-signed ECC certificates
+
+cd `dirname $0`
+
+# Create cnf for adding SAN DNS:localhost
+# See https://security.stackexchange.com/questions/190905/subject-alternative-name-in-certificate-signing-request-apparently-does-not-surv
+cat > cnf <<EOF
+[SAN]
+subjectAltName=DNS:localhost
+EOF
+
+# Generate CA
+# Important: CN names must be different for CA and client/server certs
+openssl ecparam -noout -name prime256v1 -genkey -out ca.key
+openssl req -x509 -new -key ca.key -days 3650 -subj /CN=Mongoose -out ca.crt
+
+# Generate server cert
+openssl ecparam -noout -name prime256v1 -genkey -out server.key
+openssl req -new -sha256 -key server.key -days 3650 -subj /CN=s -out server.csr
+openssl x509 -req -sha256 -in server.csr -extensions SAN -extfile cnf \
+  -CAkey ca.key -CA ca.crt -CAcreateserial -out server.crt
+
+# Generate client cert
+openssl ecparam -noout -name prime256v1 -genkey -out client.key
+openssl req -new -sha256 -key client.key -days 3650 -subj /CN=c -out client.csr
+openssl x509 -req -sha256 -in client.csr -extensions SAN -extfile cnf \
+  -CAkey ca.key -CA ca.crt -CAcreateserial -out client.crt
+
+# Verify
+openssl verify -verbose -CAfile ca.crt server.crt
+openssl verify -verbose -CAfile ca.crt client.crt
+
+# Inspect
+# openssl x509 -text -noout -ext subjectAltName -in server.crt

test/certs/server.crt

@@ -0,0 +1,9 @@
+-----BEGIN CERTIFICATE-----
+MIIBLTCB1KADAgECAgkAluqkgeuV/y8wCgYIKoZIzj0EAwIwEzERMA8GA1UEAwwI
+TW9uZ29vc2UwHhcNMjQwMzI1MTE1NTQ1WhcNMjQwNDI0MTE1NTQ1WjAMMQowCAYD
+VQQDDAFzMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMExDcDCj1g8MeQrY+Ccy
+voozGUcp7pi9M09q5GKYJ++WOEuEHDqnu4vEr/PQdgGhmeA5JmWEsztz1f0XgNuK
+MaMYMBYwFAYDVR0RBA0wC4IJbG9jYWxob3N0MAoGCCqGSM49BAMCA0gAMEUCIQCn
+K8fWr7ULIpU3Dq5IDm6NpNLd/fv4A5it0H0Un9noEAIgPdeWcFVsL7YrGfs0QkWV
+y4ES/uFAj0jdQy8Vm+jzfD8=
+-----END CERTIFICATE-----

test/certs/server.csr

@@ -0,0 +1,7 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIHFMG4CAQAwDDEKMAgGA1UEAwwBczBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
+BDBMQ3Awo9YPDHkK2PgnMr6KMxlHKe6YvTNPauRimCfvljhLhBw6p7uLxK/z0HYB
+oZngOSZlhLM7c9X9F4DbijGgADAKBggqhkjOPQQDAgNHADBEAiB4+PwVzRQn4dSE
+I958FyxOJjKlKQ9DjBZCOStqrp2IugIgbAJG26EqDew7MvZWLtCR6ug6qBU2/hjG
+0QDyaZrCHeQ=
+-----END CERTIFICATE REQUEST-----

test/certs/server.key

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIFw94mvaH1YQyHWQRMNLU62csD8nu9GHJH5mKkiuJpPDoAoGCCqGSM49
+AwEHoUQDQgAEMExDcDCj1g8MeQrY+CcyvoozGUcp7pi9M09q5GKYJ++WOEuEHDqn
+u4vEr/PQdgGhmeA5JmWEsztz1f0XgNuKMQ==
+-----END EC PRIVATE KEY-----