About enc_wolfSSL_CTX_load_verify_buffer? about sgx-ra-tls

[zhq0918]

Ｉ traced the code,and i found that ,the reason that enc_wolfSSL_CTX_load_verify_buffer returned value is -150 is the XTIME in wolfssl-ra-attester.c like this:
#ifdef WOLFSSL_SGX

time_t XTIME(time_t* tloc) {
//printf("wolfssl-ra-attester.c...XTIME...\n");

time_t x = 1512498557; /* Dec 5, 2017, 10:29 PDT */ Is the x the current time stamp?

if (tloc) *tloc = x;
return x;

}

time_t mktime(struct tm* tm) {
(void) tm;
assert(0);
return (time_t) 0;
}
#endif

[thomasknauth]

Why are you actually using enc_wolfSSL_CTX_load_verify_buffer()? Looking at the wolfSSL source, this function is for loading CA certificates. The certificate that RA-TLS generates is not a CA certificate. I am guessing that enc_wolfSSL_CTX_load_verify_buffer() tries to do some sanity checks on the certificate related to its validity period and this fails.

I'd say calling enc_wolfSSL_CTX_load_verify_buffer() within the scope of what the example is trying to demonstrate is not supported/intended. You may want to look at what exactly enc_wolfSSL_CTX_load_verify_buffer() verifies and where it obtains its time from, if you still want to pursue this route.