net: lwip: add support for built-in root certificates
Introduce Kconfig symbols WGET_BUILTIN_CACERT and
WGET_BUILTIN_CACERT_PATH to provide root certificates at build time.
Usage example:
wget -O cacert.crt https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt
make qemu_arm64_lwip_defconfig
echo CONFIG_WGET_BUILTIN_CACERT=y >>.config
echo CONFIG_WGET_BUILTIN_CACERT_PATH=cacert.crt >>.config
make olddefconfig
make -j$(nproc) CROSS_COMPILE="ccache aarch64-linux-gnu-"
qemu-system-aarch64 -M virt -nographic -cpu max \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0 -bios u-boot.bin
=> dhcp
# HTTPS transfer using the builtin CA certificates
=> wget https://digicert-tls-ecc-p384-root-g5.chain-demos.digicert.com/
1867 bytes transferred in 1 ms (1.8 MiB/s)
Bytes transferred = 1867 (74b hex)
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
diff --git a/cmd/Kconfig b/cmd/Kconfig
index 764de48..cd391d4 100644
--- a/cmd/Kconfig
+++ b/cmd/Kconfig
@@ -2184,6 +2184,20 @@
Adds the "cacert" sub-command to wget to provide root certificates
to the HTTPS engine. Must be in DER format.
+config WGET_BUILTIN_CACERT
+ bool "Built-in CA certificates"
+ depends on WGET_HTTPS
+ select BUILD_BIN2C
+
+config WGET_BUILTIN_CACERT_PATH
+ string "Path to root certificates"
+ depends on WGET_BUILTIN_CACERT
+ default "cacert.crt"
+ help
+ Set this to the path to a DER-encoded X509 file containing
+ Certification Authority certificates, a.k.a. root certificates, for
+ the purpose of authenticating HTTPS connections.
+
endif # if CMD_NET
config CMD_PXE