TLS Crypto algorithm support questions

Hi all,

I have been using the https capabilities of the new N3 over the last couple of months and they have been working really well.  

Over the last week I had been playing around with an Azure gateway based on my initial proof of concept here.

I'm getting a generic exception(s) when I try to access https://myhomemonito...us.windows.net/

I initially though it might be due to the wildcard cert,

The cert subject is

CN = servicebus.windows.net

with SANs

// Baseline check with google
Debug.Print("https://www.google.co.nz");
try
{
   using (HttpWebRequest request = (HttpWebRequest)WebRequest.Create(@"https://www.google.co.nz"))
   {
      request.Method = "GET";
      request.KeepAlive = false;
      request.Timeout = 5000;
      request.ReadWriteTimeout = 5000;

      using (var response = (HttpWebResponse)request.GetResponse())
      {
        Debug.Print("HTTP Status:"+ response.StatusCode + " : " + response.StatusDescription);
      }
   }
}
catch (Exception ex)
{
   Debug.Print(ex.Message);
}

/*
DNS Name=*.wordpress.com
DNS Name=wordpress.com
*/
Debug.Print("https://justanotherblog.wordpress.com/");
try
{
   using (HttpWebRequest request = (HttpWebRequest)WebRequest.Create(@"https://justanotherblog.wordpress.com/"))
   {
      //request.Proxy = proxy; 
      request.Method = "GET";
      request.KeepAlive = false;
      request.Timeout = 5000;
      request.ReadWriteTimeout = 5000;

      using (var response = (HttpWebResponse)request.GetResponse())
      {
         Debug.Print("HTTP Status:"+response.StatusCode + " : " + response.StatusDescription);
      }
   }
}
catch (Exception ex)
{
   Debug.Print(ex.Message);
}


/*
DNS Name=*.servicebus.windows.net
DNS Name=servicebus.windows.net
*/
Debug.Print(@"https://myhomemonitor.servicebus.windows.net/");
try
{
   using (HttpWebRequest request = (HttpWebRequest)WebRequest.Create(@"https://myhomemonitor.servicebus.windows.net/"))
   {
      //request.Proxy = proxy; 
      request.Method = "GET";
      request.KeepAlive = false;
      request.Timeout = 5000;
      request.ReadWriteTimeout = 5000;

      using (var response = (HttpWebResponse)request.GetResponse())
      {
         Debug.Print("HTTP Status:"+response.StatusCode + " : "+response.StatusDescription);
      }
   }
}
catch (Exception ex)
{
   Debug.Print(ex.Message);
}

Hi Chris,

I was intending to fire up the debugger this evening to do some more investigation. Where would be the best place to download the debug build bits from?

Odd thing is, my code used to work a few months ago (I went back and checked dates on my blog posts), but MS did update the *.servicebus.windows.net cert on 29/4/2015 which makes me wonder....

THanks

Bryn

@KiwDev

blog.devmobile.co.nz

Hi Chris,

Grabbed the source off github and fired up the debugger. Some slight issues the source may not be most recent, plus the debugger was a bit flakey but hopefully this is useful

private void SubmitRequest()

private InputNetworkStreamWrapper EstablishConnection(Uri proxyServer, Uri targetServer)

sslStream.AuthenticateAsClient(m_originalUrl.Host, null, m_caCerts, SslVerification.CertificateRequired, SslProtocols.Default);

public void AuthenticateAsClient(string targetHost, X509Certificate cert, X509Certificate[] ca, SslVerification verify, params SslProtocols[] sslProtocols)

 internal void Authenticate(bool isServer, string targetHost, X509Certificate certificate, X509Certificate[] ca, SslVerification verify, params SslProtocols[] sslProtocols)

In the debugger the parameters at this stage were

Then the debugger started to get quite flakey

I think the exception came from inside

Hope this helps, anything else I can do?

Bryn

@KiwiDev

blog.devmobile.co.nz

Hi KiwiDev,

I'm big fan of AMQP instead of HTTP and today I'm able to use service bus without problems.

However, I opened the following question on CodePlex related to SSL access from .Net MF without any replies from team :

http://netmf.codeple...m/workitem/2381

What do you think about that ? It's strictly related to certificate verification and how it works on .Net MF.

Thanks,

Paolo.

Hi Paolo,

Been a bit mad here working on a project pitch document and my MS Ignite NZ presentation.

I think it's related to the crypto options supported/setup on the CC3100.

Will build a debug version of IP Stack and drill down into the code once presentation done.

@KiwiBryn

blog.devmobile.co.nz

I don't know if the problem is related to the crypto suites supported by CC3100 but there is a very strange behaviour in SSL handshake using .Net Micro Framework.

You HTTP based methods as last step use a Socket and SSL handshake on it. It's the same in the applications I developed that use Socket directly. On my side, as I described as an issue on Net MF interpreter repository on GitHub it seems that no validation happens.

On your side (with HTTP) it seems that a bit of validation happens and now you have the problem.

Very strange ...

Paolo.