TLS Connection Handshake failes

[MilanDeruelle]

Hello Everyone!

Can anyone get a TLS connection working?

I'm using the minimal example with added

    tls = c104.TransportSecurity(validate=True, only_known=False)
    tls.set_ca_certificate(cert="./root.cer")
    tls.set_certificate(cert="./client1.cer", key="./client1-key.pem")

    tls.add_allowed_remote_certificate(cert="./server.cer")

configuration (for server and client respectively) using the example certificates from the lib60870 tls examples.
No matter what I configure or how I set it up (even with validate=False) I keep getting

TransportSecurity.event] Alarm: Certificate verification failed (t: 2, c: 6, version: TLS 1.2 remote-ip: 127.0.0.1:2404)
on the client and and on the server
TransportSecurity.event] Alarm: handshake failed for unknown reason (t: 2, c: 8, version: TLS 1.2 remote-ip: 127.0.0.1:35534)

I'm not sure if this is a bug in the software or if I'm missing something crucial, but since the documentation of the python part of the library regarding TLS is quite limited I'm running out of ideas on what to try.

Any help/ideas would be appreciated!

Best Regards!
Milan

EDIT:
I'm attaching my minimal test setup: tls_test.zip

[m-unkel]

Hey please try the provided script to generate certs:
https://github.com/Fraunhofer-FIT-DIEN/iec104-python/blob/main/bin/gen-certs.sh

But I will have a look at the example certs from lib60870c.

[MilanDeruelle]

Hey, thanks a lot for the quick answer. The generated certs work fine. I'll try if the lib60870 c version as well.

[m-unkel]

I tested the tests/client.py and tests/server.py scripts successfully against the example certificates provided in lib60870-C repository.

client.py

    tlsconf = c104.TransportSecurity(validate=True, only_known=True)
    tlsconf.set_certificate(cert=str(ROOT / "certs/client1.cer"), key=str(ROOT / "certs/client1-key.pem"))
    tlsconf.set_ca_certificate(cert=str(ROOT / "certs/root.cer"))
    tlsconf.add_allowed_remote_certificate(cert=str(ROOT / "certs/server.cer"))

server.py

    tlsconf = c104.TransportSecurity(validate=True, only_known=True)
    tlsconf.set_certificate(cert=str(ROOT / "certs/server.cer"), key=str(ROOT / "certs/server-key.pem"))
    tlsconf.set_ca_certificate(cert=str(ROOT / "certs/root.cer"))
    tlsconf.add_allowed_remote_certificate(cert=str(ROOT / "certs/client1.cer"))