X509 - Certificate verification failed, e.g. CRL, CA or signature check failed

[tsctrl]

Board

ESP32 Dev Module

Device Description

DevKit

Hardware Configuration

all attached but working fine

Version

latest master

IDE Name

IDF Component

Operating System

Windows 10

Flash frequency

80

PSRAM enabled

no

Upload speed

9600

Description

[ 73564][E][ssl_client.cpp:36] _handle_error(): [start_ssl_client():210]: (-9984) X509 - Certificate verification failed, e.g. CRL, CA or signature check failed [ 73624][E][WiFiClientSecure.cpp:132] connect(): start_ssl_client: -9984 [ 73719][W][HTTPClient.cpp:1400] returnError(): error(-1): connection refused
i would ask for anyone help that have similar kind of issue on error above ^
background:
i have a node.js server running on https local with selfsign certificates. the cert was registered to my computer and i am able to load the cert in my postman apps and able to call my local server using lan ip or localhost and also can load the response from server on browser. so i assume there is no issue on the certificate generation part.

i have similar setup as this issue and follow the step but no success:
#5021

Sketch

WiFiClientSecure *client = new WiFiClientSecure;

client->setCACert(CA_cert);
client->setCertificate(ESP_CA_cert);
client->setPrivateKey(ESP_RSA_key);

http.begin(*client, url);

Debug Message

`
[ 73564][E][ssl_client.cpp:36] _handle_error(): [start_ssl_client():210]: (-9984) X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
[ 73624][E][WiFiClientSecure.cpp:132] connect(): start_ssl_client: -9984
[ 73719][W][HTTPClient.cpp:1400] returnError(): error(-1): connection refused
`

Other Steps to Reproduce

No response

I have checked existing issues, online documentation and the Troubleshooting Guide

• I confirm I have checked existing issues, online documentation and Troubleshooting guide.

[tsctrl]

update. i am able to use domain name but not using ip. good for my use case thus closing this issue.

[jojo2massol]

I have the same issue:

[ 25461][E][ssl_client.cpp:36] _handle_error(): [start_ssl_client():270]: (-9984) X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
[ 25462][E][WifiClientSecure.cpp:135] connect(): start_ssl_client: -9984

I'm using a self-signed certificate, and I need to use it with the IP, since I'm in a local network.
Else, it works using another server with a domain name with a different rootCA.
For now, the only way to communicate is using the insecure mode, but no verification is made, and data can be intercepted using IP spoofing.
I don't know what to do.

[nayookyaw]

I also have the same error, any Guru can solve the issue?

[potatcode]

You could use client->setInsecure(); but this removes all certs/keys. It allows any connection.

void WiFiClientSecure::setInsecure()
{
    _CA_cert = NULL;
    _cert = NULL;
    _private_key = NULL;
    _pskIdent = NULL;
    _psKey = NULL;
    _use_insecure = true;
}

You could then verify the fingerprint of the servers certificate if you want to ensure you're connecting to the correct server.
bool getFingerprintSHA256(uint8_t sha256_result[32])

But you'll have you find a way to update the fingerprint on the client if the certificate expires

After some work I found that it was how the certificates were generated that was causing me issues.

#!/bin/bash

CA_IP_CN="xxx.xxx.xxx.xxx" # This shouldn't be relevant but I haven't tested
SERVER_IP_CN="xxx.xxx.xxx.xxx" # or FQDN
CLIENT_HOSTNAME="Client Device"

SUBJECT_CA="/C=SE/ST=Italy/L=Roma/O=himinds/OU=CA/CN=$CA_IP_CN"
SUBJECT_SERVER="/C=SE/ST=Italy/L=Roma/O=himinds/OU=Server/CN=$SERVER_IP_CN"
SUBJECT_CLIENT="/C=SE/ST=Italy/L=Roma/O=himinds/OU=Client/CN=$CLIENT_HOSTNAME"

function generate_CA () {
   echo "$SUBJECT_CA"
   openssl req -x509 -nodes -sha256 -newkey rsa:2048 -subj "$SUBJECT_CA"  -days 365 -keyout ca.key -out ca.crt
}

function generate_server () {
   echo "$SUBJECT_SERVER"
   openssl req -nodes -sha256 -new -subj "$SUBJECT_SERVER" -keyout server.key -out server.csr
   openssl x509 -req -sha256 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365
}

function generate_client () {
   echo "$SUBJECT_CLIENT"
   openssl req -new -nodes -sha256 -subj "$SUBJECT_CLIENT" -out client.csr -keyout client.key 
   openssl x509 -req -sha256 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365
}

generate_CA
generate_server
generate_client

This got it working for me

[jojo2massol]

The point of having https is for security ...

[potatcode]

See the second part of the answer on generating certificates

[morgan-wild]

I had the same issue

[E][ssl_client.cpp:36] _handle_error(): [start_ssl_client():216]: (-9984) X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
[E][WiFiClientSecure.cpp:133] connect(): start_ssl_client: -9984
Error on HTTP request xxxxxxxxxxxxxxxxx

It was because I used a wrong part of my certificate (let's encrypt).

To solve it, I used this tool found here

Then I typed my host, clicked 'Get certificate' and clicked on 'ISRG Root X1'.
At the bottom, there is directly the code to use for our ESP32 and it worked!