add full support for mTLS to WiFiSSLClient

[Matthew-Reidy]

At present mTLS authentication is not possible with this library rendering authentication by devices such as Arduino UNO R4 Wifi that use this library to services such as AWS IOT Core impossible.

Support would be needed for adding private and public keys as well as device certificates similar to the current function setCACert(char * root_ca)

Additional context

Related discussion:

https://forum.arduino.cc/t/mtls-on-uno-r4-wifi/1410056

[Matthew-Reidy]

looks like the setEccSlot slot function can handle client certificates for mTLS, however private keys still seem to be unsupported. I will test connecting to AWS IOT with this function.

WiFiSSLClient.h

   /**
    * @brief Sets the ECC (Elliptic Curve Cryptography) key slot and 
    * certificate for establishing secure SSL connections.
    * 
    * @param `int ecc508KeySlot` specifies the ECC key slot to be used for the SSL connection.
    * @param `const byte cert[]` is a pointer to the certificate data in the form of an array of bytes.
    * @param `int certLength` specifies the length of the certificate data array.
    */
   void setEccSlot(int ecc508KeySlot, const byte cert[], int certLength);

WiFiSSLClient.cpp

   /* if needed configure software SE for mTLS */
   if((_ecc_cert_len > 0) && (_ecc_cert != nullptr) && (_ecc_slot >= 0)) {
      modem.write_nowait(string(PROMPT(_SETECCSLOT)),res, "%s%d,%d,%d\r\n" , CMD_WRITE(_SETECCSLOT), _sock, _ecc_slot, _ecc_cert_len);
      if(!modem.passthrough((uint8_t *)_ecc_cert, _ecc_cert_len)) {
         return 0;
      }
   }

[Matthew-Reidy]

well this is starting to get frustrating...how do you put a private key in the key slot? can it be done using EEPROM? is that even possible? there is zero documentation on this.

[andreagilardoni]

Hi @Matthew-Reidy, I opened the following two PRs, which aim to allow custom certificates to be set on WiFiSSLClient, can you give them a look? #502 and arduino/uno-r4-wifi-usb-bridge#76

Keep in mind that I highly suggest you to use a CSR based approach, since you won't disclose your private key.
Like described here: https://docs.arduino.cc/tutorials/mkr-wifi-1010/securely-connecting-an-arduino-mkr-wifi-1010-to-aws-iot-core/.

I based my tests on AWS iot core on this example arduino/ArduinoCloudProviderExamples#24. Please remember to set proper policies on AWS iot core.