From bbd50368217e04c73aa4f36702db1ac72d98c17a Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 8 Sep 2026 11:04:55 -0700 Subject: [PATCH 1/9] F-11902 - Treat clock_set argument as a forward increment --- examples/timestamp/clock_set.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/examples/timestamp/clock_set.c b/examples/timestamp/clock_set.c index f1186ff2..eaca888b 100644 --- a/examples/timestamp/clock_set.c +++ b/examples/timestamp/clock_set.c @@ -112,8 +112,14 @@ int TPM2_ClockSet_Test(void* userCtx, int argc, char *argv[]) /* Set the TPM clock forward */ cmdIn.clockSet.auth = TPM_RH_OWNER; - if (newClock) - cmdIn.clockSet.newTime = newClock; + if (newClock) { + if (newClock > (UINT64)0xFFFFFFFFFFFFFFFFULL - oldClock) { + printf("Clock increment out of range\n"); + rc = BAD_FUNC_ARG; + goto exit; + } + cmdIn.clockSet.newTime = oldClock + newClock; + } else cmdIn.clockSet.newTime = oldClock + 50000; rc = TPM2_ClockSet(&cmdIn.clockSet); From b1be65ab144018b14048a0337a013ced4adc69ae Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 8 Sep 2026 11:05:05 -0700 Subject: [PATCH 2/9] F-11904 - Fail make credential when the RNG call fails --- examples/attestation/make_credential.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/examples/attestation/make_credential.c b/examples/attestation/make_credential.c index a7db449d..d224d628 100644 --- a/examples/attestation/make_credential.c +++ b/examples/attestation/make_credential.c @@ -153,8 +153,13 @@ int TPM2_MakeCredential_Example(void* userCtx, int argc, char *argv[]) XMEMSET(&makeCredIn, 0, sizeof(makeCredIn)); XMEMSET(&makeCredOut, 0, sizeof(makeCredOut)); makeCredIn.credential.size = CRED_SECRET_SIZE; - wolfTPM2_GetRandom(&dev, makeCredIn.credential.buffer, + rc = wolfTPM2_GetRandom(&dev, makeCredIn.credential.buffer, makeCredIn.credential.size); + if (rc != TPM_RC_SUCCESS) { + printf("wolfTPM2_GetRandom failed 0x%x: %s\n", rc, + TPM2_GetRCString(rc)); + goto exit; + } /* Set the object name */ if (name.size > sizeof(makeCredIn.objectName.name)) { printf("Name size %d exceeds buffer\n", name.size); From 4f89183d18000e7467798d38e1e4bd7735ac3a2b Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 8 Sep 2026 11:05:17 -0700 Subject: [PATCH 3/9] F-11905 - Report make credential blob write failures --- examples/attestation/make_credential.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/examples/attestation/make_credential.c b/examples/attestation/make_credential.c index d224d628..7e52969e 100644 --- a/examples/attestation/make_credential.c +++ b/examples/attestation/make_credential.c @@ -185,14 +185,23 @@ int TPM2_MakeCredential_Example(void* userCtx, int argc, char *argv[]) #if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) fp = XFOPEN(output, "wb"); - if (fp != XBADFILE) { - dataSize = (int)XFWRITE((BYTE*)&makeCredOut.credentialBlob, 1, - sizeof(makeCredOut.credentialBlob), fp); - if (dataSize > 0) { - dataSize += (int)XFWRITE((BYTE*)&makeCredOut.secret, 1, - sizeof(makeCredOut.secret), fp); - } - XFCLOSE(fp); + if (fp == XBADFILE) { + printf("Failed to open %s for writing\n", output); + rc = BAD_FUNC_ARG; + goto exit; + } + dataSize = (int)XFWRITE((BYTE*)&makeCredOut.credentialBlob, 1, + sizeof(makeCredOut.credentialBlob), fp); + if (dataSize == (int)sizeof(makeCredOut.credentialBlob)) { + dataSize += (int)XFWRITE((BYTE*)&makeCredOut.secret, 1, + sizeof(makeCredOut.secret), fp); + } + XFCLOSE(fp); + if (dataSize != (int)(sizeof(makeCredOut.credentialBlob) + + sizeof(makeCredOut.secret))) { + printf("Failed to write credential blob and secret to %s\n", output); + rc = BAD_FUNC_ARG; + goto exit; } printf("Wrote credential blob and secret to %s, %d bytes\n", output, dataSize); From 90baab8d4b482411bdfe86692b77d3f1e012bbf8 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 8 Sep 2026 11:06:15 -0700 Subject: [PATCH 4/9] F-11906 - Report quote output file open and write failures --- examples/pcr/quote.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/examples/pcr/quote.c b/examples/pcr/quote.c index 9e199a34..ad0e5565 100644 --- a/examples/pcr/quote.c +++ b/examples/pcr/quote.c @@ -300,9 +300,17 @@ int TPM2_PCR_Quote_Test(void* userCtx, int argc, char *argv[]) dataSz = cmdOut.quoteResult.quoted.size; #if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) f = XFOPEN(outputFile, "wb"); - if (f != XBADFILE) { - dataSz = (int)XFWRITE(data, 1, dataSz, f); - XFCLOSE(f); + if (f == XBADFILE) { + printf("Failed to open %s for writing\n", outputFile); + rc = BAD_FUNC_ARG; + goto exit; + } + dataSz = (int)XFWRITE(data, 1, dataSz, f); + XFCLOSE(f); + if (dataSz != (int)cmdOut.quoteResult.quoted.size) { + printf("Failed to write quote to %s\n", outputFile); + rc = BAD_FUNC_ARG; + goto exit; } printf("Wrote %d bytes to %s\n", dataSz, outputFile); #else From 4e073434bd41f570c3258faef201ad828c9d92f7 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 8 Sep 2026 11:06:28 -0700 Subject: [PATCH 5/9] F-11907 - Fail PKCS7 examples when the output file cannot be opened --- examples/pkcs7/pkcs7.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/examples/pkcs7/pkcs7.c b/examples/pkcs7/pkcs7.c index 3bdc248b..721c8bea 100644 --- a/examples/pkcs7/pkcs7.c +++ b/examples/pkcs7/pkcs7.c @@ -221,6 +221,10 @@ static int PKCS7_SignVerifyEx(WOLFTPM2_DEV* dev, int tpmDevId, XFCLOSE(pemFile); } + else { + printf("Failed to open %s for writing\n", outFile); + rc = -1; goto exit; + } #else (void)outFile; #endif @@ -306,6 +310,10 @@ static int PKCS7_SignVerify(WOLFTPM2_DEV* dev, int tpmDevId, rc = -1; goto exit; } } + else { + printf("Failed to open %s for writing\n", outFile); + rc = -1; goto exit; + } #else (void)outFile; #endif From 18691a8b201cfd3d7d0287f38e62f62d60c6011f Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 8 Sep 2026 11:24:03 -0700 Subject: [PATCH 6/9] F-13455 - Read a precomputed digest file when crypto is disabled --- examples/pcr/extend.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/examples/pcr/extend.c b/examples/pcr/extend.c index 608e1c97..6926b0d1 100644 --- a/examples/pcr/extend.c +++ b/examples/pcr/extend.c @@ -75,6 +75,11 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[]) enum wc_HashType hashType; wc_HashAlg dig; int hashInitialized = 0; +#elif !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) && \ + defined(WOLFTPM2_NO_WOLFCRYPT) + XFILE fp = NULL; + size_t len; + BYTE extra; #endif union { @@ -177,7 +182,26 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[]) hash, hashSz); } else -#endif /* !WOLFTPM2_NO_WOLFCRYPT && !NO_FILESYSTEM */ +#elif !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES) && \ + defined(WOLFTPM2_NO_WOLFCRYPT) + /* Crypto disabled: the file must contain a precomputed digest */ + fp = XFOPEN(filename, "rb"); + if (fp != XBADFILE) { + len = XFREAD(cmdIn.pcrExtend.digests.digests[0].digest.H, 1, + hashSz, fp); + if ((int)len == hashSz && XFREAD(&extra, 1, 1, fp) != 0) { + len = 0; /* trailing bytes mean this is not a bare digest */ + } + XFCLOSE(fp); + if ((int)len != hashSz) { + printf("Expected exactly %d digest bytes in %s\n", + hashSz, filename); + rc = BAD_FUNC_ARG; + goto exit; + } + } + else +#endif /* !NO_FILESYSTEM */ { printf("Error loading file %s, using test data\n", filename); for (i=0; i Date: Tue, 8 Sep 2026 11:27:28 -0700 Subject: [PATCH 7/9] F-13458 - Stop the extend hashing loop on a short or failed read --- examples/pcr/extend.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/examples/pcr/extend.c b/examples/pcr/extend.c index 6926b0d1..f9a5138b 100644 --- a/examples/pcr/extend.c +++ b/examples/pcr/extend.c @@ -162,11 +162,19 @@ int TPM2_PCR_Extend_Test(void* userCtx, int argc, char *argv[]) rc = wc_HashInit(&dig, hashType); if (rc == 0) hashInitialized = 1; - while (rc == 0 && !XFEOF(fp)) { + while (rc == 0) { len = XFREAD(dataBuffer, 1, sizeof(dataBuffer), fp); if (len > 0) { rc = wc_HashUpdate(&dig, hashType, dataBuffer, (int)len); } + if (len < sizeof(dataBuffer)) { + /* Short read: end of file, or an input error to report */ + if (!XFEOF(fp)) { + printf("Error reading file %s\n", filename); + rc = BAD_FUNC_ARG; + } + break; + } } XFCLOSE(fp); if (rc == 0) From 2f4b959ebb4a33aa23a510315a443b3df3b56766 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Tue, 8 Sep 2026 11:31:15 -0700 Subject: [PATCH 8/9] F-13528 - Honor peer certificate verification result in TLS examples --- examples/run_examples.sh | 34 ++++++++++++++++++++++++++-------- examples/tls/tls_client.c | 19 +++++++++++++++++++ examples/tls/tls_common.h | 10 +++------- examples/tls/tls_server.c | 19 +++++++++++++++++++ 4 files changed, 67 insertions(+), 15 deletions(-) diff --git a/examples/run_examples.sh b/examples/run_examples.sh index 6aa70f91..44262ded 100755 --- a/examples/run_examples.sh +++ b/examples/run_examples.sh @@ -652,9 +652,18 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi generate_port READY_FILE="/tmp/wolftpm_tls_ready_$$" rm -f "$READY_FILE" + # The TPM client verifies the peer, so the wolfSSL server presents a cert + # for this key type and the client trusts the CA that issued it + if [ "$1" = "ecc" ]; then + PEER_CERT_ARGS="-c ./certs/server-ecc.pem -k ./certs/ecc-key.pem" + PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-ecc-cert.pem" + else + PEER_CERT_ARGS="-c ./certs/server-cert.pem -k ./certs/server-key.pem" + PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-cert.pem" + fi pushd $WOLFSSL_PATH >> $TPMPWD/run.out 2>&1 - echo -e "./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem -R $READY_FILE" - ./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem -R "$READY_FILE" >> $TPMPWD/run.out 2>&1 & + echo -e "./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS -R $READY_FILE" + ./examples/server/server -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS -R "$READY_FILE" >> $TPMPWD/run.out 2>&1 & SERVER_PID=$! popd >> $TPMPWD/run.out 2>&1 if ! wait_for_ready "$READY_FILE" 500; then @@ -665,8 +674,8 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi fi rm -f "$READY_FILE" - echo -e "./examples/tls/tls_client -p=$port -$1 $2" - ./examples/tls/tls_client -p=$port -$1 $2 >> $TPMPWD/run.out 2>&1 + echo -e "./examples/tls/tls_client -p=$port -A=$PEER_CA_FILE -$1 $2" + ./examples/tls/tls_client -p=$port "-A=$PEER_CA_FILE" -$1 $2 >> $TPMPWD/run.out 2>&1 RESULT=$? [ $RESULT -ne 0 ] && echo -e "tpm tls client $1 $2 failed! $RESULT" && exit 1 } @@ -674,9 +683,18 @@ run_tpm_tls_client() { # Usage: run_tpm_tls_client [ecc/rsa] [tpmargs] [tlsversi run_tpm_tls_server() { # Usage: run_tpm_tls_server [ecc/rsa] [tpmargs] [tlsversion] [extraargs] echo -e "TLS test (TPM as server) $1 $2 $3" generate_port + # The TPM server verifies the peer, so the wolfSSL client presents a + # client-auth cert for this key type and the server trusts its issuer + if [ "$1" = "ecc" ]; then + PEER_CERT_ARGS="-c ./certs/client-ecc-ca-cert.pem -k ./certs/ecc-client-key.pem" + PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-ecc-cert.pem" + else + PEER_CERT_ARGS="-c ./certs/client-ca-cert.pem -k ./certs/client-key.pem" + PEER_CA_FILE="$WOLFSSL_PATH/certs/ca-cert.pem" + fi - echo -e "./examples/tls/tls_server -p=$port -$1 $2" - ./examples/tls/tls_server -p=$port -$1 $2 >> $TPMPWD/run.out 2>&1 & + echo -e "./examples/tls/tls_server -p=$port -A=$PEER_CA_FILE -$1 $2" + ./examples/tls/tls_server -p=$port "-A=$PEER_CA_FILE" -$1 $2 >> $TPMPWD/run.out 2>&1 & SERVER_PID=$! if ! wait_for_port "$port" 500; then echo -e "TPM TLS server failed to start on port $port for $1 $2" @@ -685,8 +703,8 @@ run_tpm_tls_server() { # Usage: run_tpm_tls_server [ecc/rsa] [tpmargs] [tlsversi fi pushd $WOLFSSL_PATH >> $TPMPWD/run.out 2>&1 - echo -e "./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $4" - ./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $4 >> $TPMPWD/run.out 2>&1 + echo -e "./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS $4" + ./examples/client/client -v $3 -p $port -w -g -A ./certs/tpm-ca-$1-cert.pem $PEER_CERT_ARGS $4 >> $TPMPWD/run.out 2>&1 RESULT=$? [ $RESULT -ne 0 ] && echo -e "tls client $1 $2 failed! $RESULT" && exit 1 popd >> $TPMPWD/run.out 2>&1 diff --git a/examples/tls/tls_client.c b/examples/tls/tls_client.c index 925ea571..415862a4 100644 --- a/examples/tls/tls_client.c +++ b/examples/tls/tls_client.c @@ -101,6 +101,9 @@ static void usage(void) printf("* -aes/xor: Use Parameter Encryption\n"); printf("* -h=host: Server hostname (default %s)\n", TLS_HOST); printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT); +#ifndef NO_FILESYSTEM + printf("* -A=file: Additional CA certificate file to trust\n"); +#endif #if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS) printf("* -pk: Use PK callbacks, not crypto callbacks\n"); #endif @@ -142,6 +145,9 @@ int TPM2_TLS_ClientArgs(void* userCtx, int argc, char *argv[]) #endif const char* host = TLS_HOST; int hostGiven = 0; +#ifndef NO_FILESYSTEM + const char* caFile = NULL; +#endif int useECC = 0; int usePK = 0; #ifdef WOLFTPM_TLS_PQC @@ -226,6 +232,11 @@ int TPM2_TLS_ClientArgs(void* userCtx, int argc, char *argv[]) const char* portStr = argv[argc-1] + XSTRLEN("-p="); port = (word32)XATOI(portStr); } + #ifndef NO_FILESYSTEM + else if (XSTRNCMP(argv[argc-1], "-A=", XSTRLEN("-A=")) == 0) { + caFile = argv[argc-1] + XSTRLEN("-A="); + } + #endif else { printf("Warning: Unrecognized option: %s\n", argv[argc-1]); } @@ -517,6 +528,14 @@ tls_setup: goto exit; #endif /* HAVE_ECC */ } + if (caFile != NULL) { + if (wolfSSL_CTX_load_verify_locations(ctx, caFile, + 0) != WOLFSSL_SUCCESS) { + printf("Error loading %s cert\n", caFile); + rc = -1; + goto exit; + } + } #endif /* !NO_FILESYSTEM */ /* Client Key (Mutual Authentication) */ diff --git a/examples/tls/tls_common.h b/examples/tls/tls_common.h index 26e8916d..dfc03e17 100644 --- a/examples/tls/tls_common.h +++ b/examples/tls/tls_common.h @@ -479,16 +479,12 @@ static inline int myVerify(int preverify, WOLFSSL_X509_STORE_CTX* store) printf("\tSubject's domain name at %d is %s\n", store->error_depth, store->domain); - (void)preverify; - - /* If error indicate we are overriding it for testing purposes */ if (store->error != 0) { - printf("\tAllowing failed certificate check, testing only " - "(shouldn't do this in production)\n"); + printf("\tCertificate verification failed\n"); } - /* A non-zero return code indicates failure override */ - return 1; + /* Honor the verification result instead of overriding failures */ + return preverify; } #ifndef NO_DH diff --git a/examples/tls/tls_server.c b/examples/tls/tls_server.c index 196a95dc..bb8e4f7d 100644 --- a/examples/tls/tls_server.c +++ b/examples/tls/tls_server.c @@ -122,6 +122,9 @@ static void usage(void) #endif printf("* -aes/xor: Use Parameter Encryption\n"); printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT); +#ifndef NO_FILESYSTEM + printf("* -A=file: Additional CA certificate file to trust\n"); +#endif #if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS) printf("* -pk: Use PK callbacks, not crypto callbacks\n"); #endif @@ -177,6 +180,9 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[]) int usePK = 0; int runLoop = 0; int useSelfSign = 0; +#ifndef NO_FILESYSTEM + const char* caFile = NULL; +#endif #ifdef WOLFTPM_TLS_PQC int useMLDSA = 0; TPMI_MLDSA_PARAMETER_SET mldsaSet = TPM_MLDSA_65; @@ -262,6 +268,11 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[]) const char* portStr = argv[argc-1] + XSTRLEN("-p="); port = (word32)XATOI(portStr); } + #ifndef NO_FILESYSTEM + else if (XSTRNCMP(argv[argc-1], "-A=", XSTRLEN("-A=")) == 0) { + caFile = argv[argc-1] + XSTRLEN("-A="); + } + #endif else { printf("Warning: Unrecognized option: %s\n", argv[argc-1]); } @@ -568,6 +579,14 @@ tls_setup: goto exit; #endif /* HAVE_ECC */ } + if (caFile != NULL) { + if (wolfSSL_CTX_load_verify_locations(ctx, caFile, + 0) != WOLFSSL_SUCCESS) { + printf("Error loading %s cert\n", caFile); + rc = -1; + goto exit; + } + } #endif /* !NO_FILESYSTEM */ From 0df6f5253a2183b367d25ff51b32efb6be69a058 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Thu, 10 Sep 2026 09:22:04 -0700 Subject: [PATCH 9/9] Fix TLS and no-wolfCrypt CI failures --- examples/run_examples.sh | 9 ++++++++- examples/tls/tls_client.c | 20 ++++++++++---------- examples/tls/tls_server.c | 20 ++++++++++---------- 3 files changed, 28 insertions(+), 21 deletions(-) diff --git a/examples/run_examples.sh b/examples/run_examples.sh index 44262ded..d40f7075 100755 --- a/examples/run_examples.sh +++ b/examples/run_examples.sh @@ -895,8 +895,15 @@ echo -e "PCR Quote tests" ./examples/pcr/reset 16 >> $TPMPWD/run.out 2>&1 RESULT=$? [ $RESULT -ne 0 ] && echo -e "pcr reset failed! $RESULT" && exit 1 -./examples/pcr/extend 16 /usr/bin/zip >> $TPMPWD/run.out 2>&1 +PCR_EXTEND_FILE=/usr/bin/zip +if [ $WOLFCRYPT_ENABLE -eq 0 ]; then + # Without wolfCrypt, extend expects a raw, precomputed SHA-256 digest. + PCR_EXTEND_FILE="$TPMPWD/pcr-extend.digest" + printf '%s' '0123456789abcdef0123456789abcdef' > "$PCR_EXTEND_FILE" +fi +./examples/pcr/extend 16 "$PCR_EXTEND_FILE" >> $TPMPWD/run.out 2>&1 RESULT=$? +[ $WOLFCRYPT_ENABLE -eq 0 ] && rm -f "$PCR_EXTEND_FILE" [ $RESULT -ne 0 ] && echo -e "pcr extend file failed! $RESULT" && exit 1 ./examples/pcr/quote 16 zip.quote >> $TPMPWD/run.out 2>&1 RESULT=$? diff --git a/examples/tls/tls_client.c b/examples/tls/tls_client.c index 415862a4..e3f84399 100644 --- a/examples/tls/tls_client.c +++ b/examples/tls/tls_client.c @@ -102,7 +102,7 @@ static void usage(void) printf("* -h=host: Server hostname (default %s)\n", TLS_HOST); printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT); #ifndef NO_FILESYSTEM - printf("* -A=file: Additional CA certificate file to trust\n"); + printf("* -A=file: CA certificate file to trust\n"); #endif #if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS) printf("* -pk: Use PK callbacks, not crypto callbacks\n"); @@ -490,7 +490,15 @@ tls_setup: } #else /* Load CA Certificates */ - if (!useECC) { + if (caFile != NULL) { + if (wolfSSL_CTX_load_verify_locations(ctx, caFile, + 0) != WOLFSSL_SUCCESS) { + printf("Error loading %s cert\n", caFile); + rc = -1; + goto exit; + } + } + else if (!useECC) { #ifndef NO_RSA if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/ca-rsa-cert.pem", 0) != WOLFSSL_SUCCESS) { @@ -528,14 +536,6 @@ tls_setup: goto exit; #endif /* HAVE_ECC */ } - if (caFile != NULL) { - if (wolfSSL_CTX_load_verify_locations(ctx, caFile, - 0) != WOLFSSL_SUCCESS) { - printf("Error loading %s cert\n", caFile); - rc = -1; - goto exit; - } - } #endif /* !NO_FILESYSTEM */ /* Client Key (Mutual Authentication) */ diff --git a/examples/tls/tls_server.c b/examples/tls/tls_server.c index bb8e4f7d..08d5c10d 100644 --- a/examples/tls/tls_server.c +++ b/examples/tls/tls_server.c @@ -123,7 +123,7 @@ static void usage(void) printf("* -aes/xor: Use Parameter Encryption\n"); printf("* -p=port: Supply a custom port number (default %d)\n", TLS_PORT); #ifndef NO_FILESYSTEM - printf("* -A=file: Additional CA certificate file to trust\n"); + printf("* -A=file: CA certificate file to trust\n"); #endif #if defined(WOLFTPM_CRYPTOCB) && defined(HAVE_PK_CALLBACKS) printf("* -pk: Use PK callbacks, not crypto callbacks\n"); @@ -537,7 +537,15 @@ tls_setup: #endif #else /* Load CA Certificates */ - if (!useECC) { + if (caFile != NULL) { + if (wolfSSL_CTX_load_verify_locations(ctx, caFile, + 0) != WOLFSSL_SUCCESS) { + printf("Error loading %s cert\n", caFile); + rc = -1; + goto exit; + } + } + else if (!useECC) { #ifndef NO_RSA if (wolfSSL_CTX_load_verify_locations(ctx, CA_RSA_CERT_PATH, 0) != WOLFSSL_SUCCESS) { @@ -579,14 +587,6 @@ tls_setup: goto exit; #endif /* HAVE_ECC */ } - if (caFile != NULL) { - if (wolfSSL_CTX_load_verify_locations(ctx, caFile, - 0) != WOLFSSL_SUCCESS) { - printf("Error loading %s cert\n", caFile); - rc = -1; - goto exit; - } - } #endif /* !NO_FILESYSTEM */