DocID027745 Rev 1

13/31

AN4683

SPWF01Sxxx use modes

31

Note:

This mode is particularly attractive for privacy-preserving solutions and also for low memory

consumption, since it does not require certificates storage. But it increases the chance for

intruder-in-the-middle attacks.

Figure 5 lists the AT required commands for opening a secure connection with anonymous

negotiation, followed by writing to and reading sockets.

Figure 5. AT commands for anonymous negotiation

2.4.2

One-way authentication

In one-way authentication mode, the server sends its signed certificate to an

unauthenticated client.

In order to verify the server certificate, the client:

1.

verifies the digital signature

2.

checks that the date of the certificate is in range

3.

verifies the domain

To achieve this purpose, the following steps must be completed:

1.

the issuing root CA certificate must be loaded in advance into client (see

AT+S.TLSCERT) in PEM format.

2.

To check the date, the module reference time must be initialized after each module

reset (see AT+S.SETTIME): the time refers to UTC format and must be expressed as

the time in seconds since 1970-Jan-01.

3.

The domain passed to the client (see AT+S.TLSDOMAIN) must match the name

specified in the server certificate (Common Name or others).

If the verification of the server certificate succeeds, the connection proceeds as normal.