[Interest] How to trust certificates for QWebPage

[Tom Isaacson]

We're implementing an application on an embedded Linux device that includes a browser using QWebPage in Qt 4.8.2. We also have OpenSSL installed but when I try to use https it fails with the error "SSL handshake failed". I can avoid this by calling ignoreSslErrors() in QWebPage::sslErrorHandler() but this isn't a solution.

The way I think this should work is that when the device receives the certificate it should check it with the certificate authority. Is there some code I need to add to do this? Alternatively, because this is a custom embedded Linux device I'm wondering if I need to add some kind of certificate, since it doesn't have anything right now. I can see from the code at the bottom of this article that it's possible to add certificates but I don't know what kind of certificate or where to get it from:
http://www.qtforum.org/article/37666/qwebview-not-displaying-some-ssl-pages-on-windows-qt-4-8-mingw.html

Any suggestions would be a great help, thanks.

Tom Isaacson

[Richard Moore]

What you need to do is create your own CA certificate, then generate a leaf
certificate that is signed by it for your server. You then get the
QNetworkAccessManager that you're using to load the content for your
QWebPage and get its QSslConfiguration. Finally use setCaCertificate on the
configuration to tell it to trust certificates signed by your custom CA.

Cheers

Rich.


On 26 May 2014 11:30, Tom Isaacson <***@navico.com> wrote:

> We're implementing an application on an embedded Linux device that
> includes a browser using QWebPage in Qt 4.8.2. We also have OpenSSL
> installed but when I try to use https it fails with the error "SSL
> handshake failed". I can avoid this by calling ignoreSslErrors() in
> QWebPage::sslErrorHandler() but this isn't a solution.
>
> The way I think this should work is that when the device receives the
> certificate it should check it with the certificate authority. Is there
> some code I need to add to do this? Alternatively, because this is a custom
> embedded Linux device I'm wondering if I need to add some kind of
> certificate, since it doesn't have anything right now. I can see from the
> code at the bottom of this article that it's possible to add certificates
> but I don't know what kind of certificate or where to get it from:
>
> http://www.qtforum.org/article/37666/qwebview-not-displaying-some-ssl-pages-on-windows-qt-4-8-mingw.html
>
> Any suggestions would be a great help, thanks.
>
> Tom Isaacson
>
>
>
> _______________________________________________
> Interest mailing list
> ***@qt-project.org
> http://lists.qt-project.org/mailman/listinfo/interest
>

[Tom Isaacson]

I don't understand that first sentence. What do you mean by "your server"? If I'm trying to use https on, for example, Twitter, how do I create a certificate for it?

Tom

From: interest-bounces+tom.isaacson=***@qt-project.org [mailto:interest-bounces+tom.isaacson=***@qt-project.org] On Behalf Of Richard Moore
Sent: Tuesday, 27 May 2014 1:11 a.m.
To: ***@qt-project.org
Subject: Re: [Interest] How to trust certificates for QWebPage

What you need to do is create your own CA certificate, then generate a leaf certificate that is signed by it for your server. You then get the QNetworkAccessManager that you're using to load the content for your QWebPage and get its QSslConfiguration. Finally use setCaCertificate on the configuration to tell it to trust certificates signed by your custom CA.

Cheers

Rich.

On 26 May 2014 11:30, Tom Isaacson <***@navico.com> wrote:
We're implementing an application on an embedded Linux device that includes a browser using QWebPage in Qt 4.8.2. We also have OpenSSL installed but when I try to use https it fails with the error "SSL handshake failed". I can avoid this by calling ignoreSslErrors() in QWebPage::sslErrorHandler() but this isn't a solution.

The way I think this should work is that when the device receives the certificate it should check it with the certificate authority. Is there some code I need to add to do this? Alternatively, because this is a custom embedded Linux device I'm wondering if I need to add some kind of certificate, since it doesn't have anything right now. I can see from the code at the bottom of this article that it's possible to add certificates but I don't know what kind of certificate or where to get it from:
http://www.qtforum.org/article/37666/qwebview-not-displaying-some-ssl-pages-on-windows-qt-4-8-mingw.html

Any suggestions would be a great help, thanks.

Tom Isaacson

[Thiago Macieira]

Em seg 26 maio 2014, às 18:42:31, Tom Isaacson escreveu:
> I don't understand that first sentence. What do you mean by "your server"?
> If I'm trying to use https on, for example, Twitter, how do I create a
> certificate for it?

You don't. It already has a certificate that is signed by a trusted CA.

Your platform should already support it and not produce SSL handshake errors.
If you're having SSL handshake errors with servers like twitter, please run
this:

openssl s_client -connect twitter.com:443 -verify 1

Check if it verified correctly without errors. If it didn't, please fix your
OpenSSL installation.

--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel Open Source Technology Center

[Tom Isaacson]

It returns 27 (certificate not trusted), but I also see 20 (unable to get local issuer certificate):

root:~# openssl s_client -connect twitter.com:443 -verify 1
verify depth is 1
CONNECTED(00000003)
depth=1 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = Terms of use at https://www.verisign.com/rpa (c)06, CN = VeriSign Class 3 Extended Validation SSL CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=1 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = Terms of use at https://www.verisign.com/rpa (c)06, CN = VeriSign Class 3 Extended Validation SSL CA
verify error:num=27:certificate not trusted
verify return:1
depth=0 1.3.6.1.4.1.311.60.2.1.3 = US, 1.3.6.1.4.1.311.60.2.1.2 = Delaware, businessCategory = Private Organization, serialNumber = 4337446, C = US, postalCode = 94103-1307, ST = California, L = San Francisco, street = 1355 Market St, O = "Twitter, Inc.", OU = Twitter Security, CN = twitter.com
verify return:1
---
Certificate chain
0 s:/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/businessCategory=Private Organization/serialNumber=4337446/C=US/postalCode=94103-1307/ST=California/L=San Francisco/street=1355 Market St/O=Twitter, Inc./OU=Twitter Security/CN=twitter.com
i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL CA
1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL CA
i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGCjCCBPKgAwIBAgIQNC7E3U4iWJiTy5wznxxGDDANBgkqhkiG9w0BAQsFADCB
ujELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNjE0MDIGA1UEAxMr
VmVyaVNpZ24gQ2xhc3MgMyBFeHRlbmRlZCBWYWxpZGF0aW9uIFNTTCBDQTAeFw0x
NDA0MDgwMDAwMDBaFw0xNjA1MDkyMzU5NTlaMIIBEjETMBEGCysGAQQBgjc8AgED
EwJVUzEZMBcGCysGAQQBgjc8AgECEwhEZWxhd2FyZTEdMBsGA1UEDxMUUHJpdmF0
ZSBPcmdhbml6YXRpb24xEDAOBgNVBAUTBzQzMzc0NDYxCzAJBgNVBAYTAlVTMRMw
EQYDVQQRFAo5NDEwMy0xMzA3MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH
FA1TYW4gRnJhbmNpc2NvMRcwFQYDVQQJFA4xMzU1IE1hcmtldCBTdDEWMBQGA1UE
ChQNVHdpdHRlciwgSW5jLjEZMBcGA1UECxQQVHdpdHRlciBTZWN1cml0eTEUMBIG
A1UEAxQLdHdpdHRlci5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQDGh6KKnZPGMiX5lC8Me9pev8CWscg5cIifrEV5WVW2v8sCoFlBDdnnIw26tqku
c/uL2aJoB8LAxllik0eNWRq9Q4YDRNuW05YIRQMEgRmAZvIKBpcLCcsB7YVLY7Jp
FBWGOEiUmL2c6GTc2NQWa723Jqwc6VgXZjDiL+wpHKUYc5RZz4IO3SdJ/Xlq38te
t5ZffCp/LBhhYNNUMStjEGdQwZCcnWF1DuaZ5TgxzdSGBSdFhssh5aCQO65TjQVn
cx4g8LNhXHNO7UxNIbEtuPmc0J8amPRHA0euHrgp2wBRZ0tL8Xphm0be3uAoA3DE
dO/d4wTMBNn5pN13Z9kYhzW/AgMBAAGjggGvMIIBqzAnBgNVHREEIDAeggt0d2l0
dGVyLmNvbYIPd3d3LnR3aXR0ZXIuY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQD
AgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBEBgNVHSAEPTA7MDkG
C2CGSAGG+EUBBxcGMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWdu
LmNvbS9jcHMwHQYDVR0OBBYEFBdQCycEZZ1SEbOZAgDknEo1GgKeMB8GA1UdIwQY
MBaAFPyKULqeuSVae1WFT5UAY4/pWGtDMEIGA1UdHwQ7MDkwN6A1oDOGMWh0dHA6
Ly9FVlNlY3VyZS1jcmwudmVyaXNpZ24uY29tL0VWU2VjdXJlMjAwNi5jcmwwfAYI
KwYBBQUHAQEEcDBuMC0GCCsGAQUFBzABhiFodHRwOi8vRVZTZWN1cmUtb2NzcC52
ZXJpc2lnbi5jb20wPQYIKwYBBQUHMAKGMWh0dHA6Ly9FVlNlY3VyZS1haWEudmVy
aXNpZ24uY29tL0VWU2VjdXJlMjAwNi5jZXIwDQYJKoZIhvcNAQELBQADggEBAIfv
GC219t5efjKTRhtwn2lEtWaQpsYlSyeN8KxLnVJlHRb5z1j8oJER6JmjeqelTvZ1
RlxZ3A8cQdrntpeh9kFkU3wMK6TjaMKYDrIaFzV1M4FXsqBbJ6vAb2GX1lDu7oxS
/FrNXH9ebFclDDlXJ3FWGbABxf+xpeowr9y+Md5xgQ0Lpm82NZFei9zuJayJYh4B
ZbIJ4D9XBa73ZqIBvGXixeahHIvBA9Q0T92gQDJoMXuQ3RkVt63lL4EoJaEQNr1f
JDn2Wb0MFtKokWF1zb86glCCb7nvc/vbotiWzZt+a49XSByZ1F17I49F/N5cU9ZU
DQzsM2ToLAU2fwA6h/U=
-----END CERTIFICATE-----
subject=/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/businessCategory=Private Organization/serialNumber=4337446/C=US/postalCode=94103-1307/ST=California/L=San Francisco/street=1355 Market St/O=Twitter, Inc./OU=Twitter Security/CN=twitter.com
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL CA
---
No client certificate CA names sent
---
SSL handshake has read 3724 bytes and written 643 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID: 478202D965D85A5E36C1B6007EE0920CB806670D0F6E5312532E39E4D98F83A8
Session-ID-ctx:
Master-Key: 92E040B491834D75640CE00321F01A43B6E62869141176F0AE1398C0C859250387A9AC6127F80C8DE83E3D20332A39FB
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 129600 (seconds)
TLS session ticket:
0000 - a5 d1 d7 c3 86 fd 8d 1c-05 ce f6 b8 3d 00 a2 90 ............=...
0010 - 51 a2 81 79 64 75 14 3b-e6 98 f6 90 12 b4 a7 f1 Q..ydu.;........
0020 - b5 7c 32 0e 33 79 44 d0-ca d7 ba 6f 0f 43 66 f3 .|2.3yD....o.Cf.
0030 - 7c da b6 38 c7 58 89 ee-92 99 a5 26 d9 93 f0 f0 |..8.X.....&....
0040 - bb cb 63 e0 bb b0 19 b0-9e cc 82 d5 cb 19 3d 6b ..c...........=k
0050 - be fc b5 15 b9 d2 07 4c-97 da b3 bf 6a 9b 82 f0 .......L....j...
0060 - e4 89 4c a1 46 a8 1b 22-8e f5 4f a2 bd fd ce e3 ..L.F.."..O.....
0070 - cb 40 c7 ca 38 24 2f fc-38 c0 ce b5 28 8b 4e 4f ***@..8$/.8...(.NO
0080 - 06 da de d1 e9 2d 8d 93-10 26 77 c0 26 52 17 4c .....-...&w.&R.L
0090 - 24 d4 50 5f 29 49 2e db-9a a3 e6 72 82 03 30 62 $.P_)I.....r..0b

Start Time: 1401182659
Timeout : 300 (sec)
Verify return code: 27 (certificate not trusted)
---
closed

Tom Isaacson

-----Original Message-----
From: interest-bounces+tom.isaacson=***@qt-project.org [mailto:interest-bounces+tom.isaacson=***@qt-project.org] On Behalf Of Thiago Macieira
Sent: Tuesday, 27 May 2014 7:41 a.m.
To: ***@qt-project.org
Subject: Re: [Interest] How to trust certificates for QWebPage

Em seg 26 maio 2014, às 18:42:31, Tom Isaacson escreveu:
> I don't understand that first sentence. What do you mean by "your server"?
> If I'm trying to use https on, for example, Twitter, how do I create a
> certificate for it?

You don't. It already has a certificate that is signed by a trusted CA.

Your platform should already support it and not produce SSL handshake errors.
If you're having SSL handshake errors with servers like twitter, please run
this:

openssl s_client -connect twitter.com:443 -verify 1

Check if it verified correctly without errors. If it didn't, please fix your OpenSSL installation.

--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel Open Source Technology Center

[Bob Hood]

On 5/26/2014 3:25 PM, Tom Isaacson wrote:
> It returns 27 (certificate not trusted), but I also see 20 (unable to get local issuer certificate):

I get exactly the same result output with my OpenSSL (1.0.1g, 64-bit)
installation.

[Tom Isaacson]

Thanks for that. So why is it if I try to open Twitter in my browser I get error 6 "SSL handshake failed"?

Tom Isaacson

-----Original Message-----
From: interest-bounces+tom.isaacson=***@qt-project.org [mailto:interest-bounces+tom.isaacson=***@qt-project.org] On Behalf Of Bob Hood
Sent: Tuesday, 27 May 2014 9:48 a.m.
To: ***@qt-project.org
Subject: Re: [Interest] How to trust certificates for QWebPage

On 5/26/2014 3:25 PM, Tom Isaacson wrote:
> It returns 27 (certificate not trusted), but I also see 20 (unable to get local issuer certificate):

I get exactly the same result output with my OpenSSL (1.0.1g, 64-bit) installation.

[Thiago Macieira]

Em seg 26 maio 2014, às 15:48:01, Bob Hood escreveu:
> On 5/26/2014 3:25 PM, Tom Isaacson wrote:
> > It returns 27 (certificate not trusted), but I also see 20 (unable to get
local issuer certificate):
> I get exactly the same result output with my OpenSSL (1.0.1g, 64-bit)
> installation.

It works fine here.

Anyway, it looks like your OpenSSL (for the both of you) isn't properly
installed. If you're running Linux, please complain to your Linux
distribution.

If you're on OS X or Windows, check if Safari or Internet Explorer complain on
that website (no other browser; no Firefox, no Chrome / Chromium).
--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel Open Source Technology Center

[Bob Hood]

On 5/26/2014 6:48 PM, Thiago Macieira wrote:
> Em seg 26 maio 2014, às 15:48:01, Bob Hood escreveu:
>> On 5/26/2014 3:25 PM, Tom Isaacson wrote:
>>> It returns 27 (certificate not trusted), but I also see 20 (unable to get
> local issuer certificate):
>> I get exactly the same result output with my OpenSSL (1.0.1g, 64-bit)
>> installation.
> It works fine here.
>
> Anyway, it looks like your OpenSSL (for the both of you) isn't properly
> installed. If you're running Linux, please complain to your Linux
> distribution.
>
> If you're on OS X or Windows, check if Safari or Internet Explorer complain on
> that website (no other browser; no Firefox, no Chrome / Chromium).

Windows version here.

I don't have a Twitter account, but going to https://www.twitter.com in IE
gives me no visible complaints at the log-in screen. If I should expect to
see certificate complaints there, it must be my OpenSSL.

[Thiago Macieira]

Em seg 26 maio 2014, às 19:07:06, Bob Hood escreveu:
> > If you're on OS X or Windows, check if Safari or Internet Explorer
> > complain on that website (no other browser; no Firefox, no Chrome /
> > Chromium).
> Windows version here.
>
> I don't have a Twitter account, but going to https://www.twitter.com in IE
> gives me no visible complaints at the log-in screen. If I should expect to
> see certificate complaints there, it must be my OpenSSL.

For Windows, we try and get the certificates from the IE certificate store. The
openssl command won't work.

Anyway, the OP talked about embedded Linux device. Please complain to the
developers of that Linux distribution.
--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel Open Source Technology Center

[Tom Isaacson]

That's the point - it's our distro because we manufacture a device with embedded Linux but I don't know what certificates I need (if any) or where to get them.

I've tried complaining to myself but I just refuse to listen :)

Tom

-----Original Message-----
From: interest-bounces+tom.isaacson=***@qt-project.org [mailto:interest-bounces+tom.isaacson=***@qt-project.org] On Behalf Of Thiago Macieira
Sent: Tuesday, 27 May 2014 1:18 p.m.
To: ***@qt-project.org
Subject: Re: [Interest] How to trust certificates for QWebPage

Em seg 26 maio 2014, às 19:07:06, Bob Hood escreveu:
> > If you're on OS X or Windows, check if Safari or Internet Explorer
> > complain on that website (no other browser; no Firefox, no Chrome /
> > Chromium).
> Windows version here.
>
> I don't have a Twitter account, but going to https://www.twitter.com
> in IE gives me no visible complaints at the log-in screen. If I
> should expect to see certificate complaints there, it must be my OpenSSL.

For Windows, we try and get the certificates from the IE certificate store. The openssl command won't work.

Anyway, the OP talked about embedded Linux device. Please complain to the developers of that Linux distribution.
--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel Open Source Technology Center

[Thiago Macieira]

Em ter 27 maio 2014, às 01:31:27, Tom Isaacson escreveu:
> That's the point - it's our distro because we manufacture a device with
> embedded Linux but I don't know what certificates I need (if any) or where
> to get them.
>
> I've tried complaining to myself but I just refuse to listen :)

Then stop rolling out your own Linux distribution. If you don't know how to do
that, just get a pre-made one or use Yocto to create your distribution.

You need the certificates for all CAs that sign certificates that you'll need to
verify. That is, every site, every SSL connection that any program on your
device will ever need to make, from the moment that you ship it until the last
day that the consumer powers it off.

That includes sites that don't exist yet and signed by CAs that don't exist
yet.

--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel Open Source Technology Center

[Richard Moore]

On 27 May 2014 02:31, Tom Isaacson <***@navico.com> wrote:

> That's the point - it's our distro because we manufacture a device with
> embedded Linux but I don't know what certificates I need (if any) or where
> to get them.
>
> I've tried complaining to myself but I just refuse to listen :)
>

Maintaining a CA bundle is a lot of work, you can find a place to start
with the one provided by the curl team
http://curl.haxx.se/docs/caextract.html however, you're going to have to
consider how you plan to keep this updated.

Cheers

Rich.

[Tom Isaacson]

Thanks for the constructive comments. We're not expecting to support a browser that can visit any website on the internet, just a small list that's relevant to our device, so I'm hoping this is more manageable. The problem is that I just don't know where to start, but that link is a good place.

Tom Isaacson

From: interest-bounces+tom.isaacson=***@qt-project.org [mailto:interest-bounces+tom.isaacson=***@qt-project.org] On Behalf Of Richard Moore
Sent: Tuesday, 27 May 2014 9:21 p.m.
To: ***@qt-project.org
Subject: Re: [Interest] How to trust certificates for QWebPage



On 27 May 2014 02:31, Tom Isaacson <***@navico.com> wrote:
That's the point - it's our distro because we manufacture a device with embedded Linux but I don't know what certificates I need (if any) or where to get them.

I've tried complaining to myself but I just refuse to listen :)

Maintaining a CA bundle is a lot of work, you can find a place to start with the one provided by the curl team http://curl.haxx.se/docs/caextract.html however, you're going to have to consider how you plan to keep this updated.

Cheers

Rich.

[Thiago Macieira]

Em ter 27 maio 2014, às 09:52:42, Tom Isaacson escreveu:
> Thanks for the constructive comments. We're not expecting to support a
> browser that can visit any website on the internet, just a small list
> that's relevant to our device, so I'm hoping this is more manageable. The
> problem is that I just don't know where to start, but that link is a good
> place.

You should start with your own CA.

Create a CA for your company / device / device family, etc. Then create a
certificate signed by this CA and deploy it on the server. The CA's certificate
should be installed on the device, either as a global OpenSSL setting or by
using QSslConfiguration to set the CA list.

Mind you: please make it sure that you can upgrade the CA list, even if it
contains only one entry. You may want to add more in the future. Though this
might be done as part of the firmware upgrade.

--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel Open Source Technology Center

[Koehne Kai]

> -----Original Message-----
> From: interest-bounces+kai.koehne=***@qt-project.org
> [mailto:interest-bounces+kai.koehne=***@qt-project.org] On Behalf
>
> Windows version here.
>
> I don't have a Twitter account, but going to https://www.twitter.com in IE
> gives me no visible complaints at the log-in screen. If I should expect to see
> certificate complaints there, it must be my OpenSSL.

I'm 95% sure that Qt on Windows does check directly against the Windows certificate API, instead (in addition to?) of OpenSSL's internal one.

Regards

Kai

[Richard Moore]

On 27 May 2014 08:11, Koehne Kai <***@digia.com> wrote:

>
> I'm 95% sure that Qt on Windows does check directly against the Windows
> certificate API, instead (in addition to?) of OpenSSL's internal one.
>

We use the certificates in the windows CA store yes. There is no internal
CA store in openssl.

Rich.

[Richard Moore]

On 26 May 2014 19:42, Tom Isaacson <***@navico.com> wrote:

> I don't understand that first sentence. What do you mean by "your server"?
> If I'm trying to use https on, for example, Twitter, how do I create a
> certificate for it?
>

I assumed from your description you were trying to get your embedded device
to communicate with another device under your control. In fact, it sounds
like you've simply got openssl setup but not provided any trust store.
Openssl doesn't come with one, so you'll need to create one for your device
(note that this is something you'll have to maintain too since over time
the set of root CAs you'll want will change).

Cheers

Rich.