CA证书 mbedtls

100 mbedtls 使用证书错误请教

发布于 2025-07-19 15:53:25 浏览：116 订阅该版

测试rtt带的例程

```c
#define MBEDTLS_WEB_SERVER  "www.rt-thread.org"
#define MBEDTLS_WEB_PORT    "443"

#define MBEDTLS_READ_BUFFER 1024

static const char *REQUEST = "GET /download/rt-thread.txt HTTP/1.1\r\n"
    "Host: www.rt-thread.org\r\n"
    "User-Agent: rtthread/3.1 rtt\r\n"
    "\r\n";
#endif
```
应答正常：

```c
HTTP/1.1 200 OK
Date: Sat, 19 Jul 2025 07:41:27 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 267
Connection: keep-alive
Vary: Accept-Encoding
x-oss-request-id: 687B4C26DA7A37383109FDEC
Accept-Ranges: bytes
ETag: "749C784282FAA16C2000C57EDEC7E4AB"
Last-Modified: Tue, 20 Oct 2020 03:55:17 GMT
x-oss-object-type: Normal
x-oss-hash-crc64ecma: 9455171224755408897
x-oss-storage-class: Standard
x-oss-version-id: null
Content-MD5: dJx4QoL6oWwgAMV+3sfkqw==
x-oss-server-time: 81
Strict-Transport-Security: max-age=1800; includeSubdomains; preload
Set-Cookie: sl-session=JJ5gG6edfGiUh3v6xgVBkA==; SameSite=None; Secure; Path=/; Max-Age=86400; HttpOnly
Strict-Transport-Security: max-age=15768000;

RT-Thread is an open source IoT operating system from China, which has strong scalability: from a tiny kernel running on a tiny core, for example ARM Cortex-M0, or Cortex-M3/4/7, to a rich feature system running on MIPS32, ARM Cortex-A8, ARM Cortex-A9 DualCore etc.
```

```
[E/mbedtls.clnt] verify peer certificate fail....
[E/mbedtls.clnt] verification info:   ! The certificate is not correctly signed by the trusted CA

[E/web] connect failed, https client connect return: -0x1
```

测试webclientget程序 
https://www.rt-thread.org/download/rt-thread.txt

程序应答正常

![screenshot_image.png](https://oss-club.rt-thread.org/uploads/20250719/5c1fc5973a9ca386188be759070b68e4.png)

在测试
"https://www.rt-thread.com/service/rt-thread.txt"

提示证书失败

![screenshot_image.png](https://oss-club.rt-thread.org/uploads/20250719/85986e14a56648767b3cdfdc65d19023.png)

```
[E/mbedtls.clnt] verify peer certificate fail....
[E/mbedtls.clnt] verification info:   ! The certificate is not correctly signed by the trusted CA

[E/web] connect failed, https client connect return: -0x1
```

```c
[E/mbedtls.clnt] verify peer certificate fail....
[E/mbedtls.clnt] verification info:   ! The certificate is not correctly signed by the trusted CA

[E/web] connect failed, https client connect return: -0x1
```

证书配置

![screenshot_image.png](https://oss-club.rt-thread.org/uploads/20250719/207f6f5a8f6f9c8d13a7e2541fa690fe.png)

配置完成之后，又额外增加了网站证书
```
const char mbedtls_root_certificate[]
```

https://www.rt-thread.com 网站证书
![screenshot_image.png](https://oss-club.rt-thread.org/uploads/20250719/c5f4c6ded233671383570e6914c8d244.png)

程序里面也确认已经增加了这个证书

![screenshot_image.png](https://oss-club.rt-thread.org/uploads/20250719/0da7d9d578891fc13d464e61316a89ab.png)

后面再继续测试
https://www.howsmyssl.com/a/check
反馈的情况和刚刚一样证书失败....

![screenshot_image.png](https://oss-club.rt-thread.org/uploads/20250719/41df2ab803a23749eaa4208885f0cfc6.png)
问题是网站这个证书已经添加到const char mbedtls_root_certificate[] 里面

![screenshot_image.png](https://oss-club.rt-thread.org/uploads/20250719/675ba2e0a0b396b4e1ab5c256a0e457a.png)

请教一下，这个错误还需要怎么设置才能解决？是对添加网站证书理解不对吗？
```
[E/mbedtls.clnt] verify peer certificate fail....
[E/mbedtls.clnt] verification info:   ! The certificate is not correctly signed by the trusted CA

[E/web] connect failed, https client connect return: -0x1
```

非常感谢坛友指导一下