[SOLVED] NodeMCU ES8266CH340 Send POST request with WifiClientSecure and SSL fingerprint is failed. Returned httpCode -1

Projects General Guidance
1

I've NodeMCU ESP8266CH340. Unable to verify fingerprint of SSL (Issued by Google Trust) with WifiClientSecure. I don't want to set client.setInsecure(); or bypass SSL verification. POST request failed and returned httpCode -1. Please help me.

//ADC_MODE(ADC_VCC) //To read Temp, VCC potential
#define DEBUG  //Set debug environment
#pragma GCC optimize("Ofast") //For fast execustion (aggressive optimization)

//Header files
#include <cstddef>
#include <Arduino.h>
#include <ESP8266WiFi.h>
#include <ESP8266WebServer.h>
#include <ESP8266mDNS.h>
#include <ESP8266HTTPClient.h>
#include <NTPClient.h>

IPAddress remote_ip;
ESP8266WebServer server(80);
WiFiUDP ntpUDP;

const long utcOffsetInSeconds = 19800; //Timezone: Asia/Kolkata (IST/GMT+5:30)
NTPClient timeClient(ntpUDP, "pool.ntp.org", utcOffsetInSeconds);


int D1 = 5;
int raw = analogRead(A0);
float vcc = 1.0*1024.0/raw; //Read VCC potential
float temp = (raw-21)/1.7; //Read CPU temp

//Fingerprint of API endpoint to verify SSL/TLS
const char fingerprint[] PROGMEM = "FF:46:2F:ED:A1:38:BA:98:4D:CD:DA:B5:AE:9B:A5:D1:00:12:04:D5:77:95:A4:77:B2:41:ED:37:42:35:A5:71";

void setup() {
  //To ctrl DC FAN motor
  pinMode(D1,OUTPUT);
  digitalWrite(D1,LOW);

  //Begin Serial monitor (COM port)
  Serial.begin(115200);
  timeClient.begin();//Begin fetching timestamp

  WiFi.mode(WIFI_AP_STA);
  WiFi.hostname("Jabilli");
  WiFi.setSleepMode(WIFI_LIGHT_SLEEP);

  //Connect to router for internet
  WiFi.begin("CHETAN SAI","XXXXXXXX");

  //Setup Local Area Network (LAN)
  Serial.println();
  Serial.print("Setting up Soft-AP... ");
  if (WiFi.softAP("Jabilli", "987654321",1,false)) {
    Serial.println("Access Point Established.");
  } else {
    Serial.println("AP initialization Failed!");
  }

  //Check WiFi conn status
  while (WiFi.status() != WL_CONNECTED) {
    delay(1000);
    Serial.print(".");
  }
 
  //Start mDNS responder to softAPIP
  if (MDNS.begin("jabilli")) {
    Serial.println("mDNS responder started");
    Serial.println("Access your device at http://jabilli.local");
    Serial.print("NodeMCU IP Address: ");
    Serial.println(WiFi.softAPIP());
  } else {
    Serial.println("Error with Access Point mDNS responder!");
  }

  MDNS.addService("http", "tcp", 80);
    server.on("/", HTTP_GET, []() {
      server.send(200, "text/html", "Sending GET request...");
      //sendPostReq();
  });

    // Start the server
  server.begin();
  Serial.println("HTTP server started");
}

void IRAM_ATTR sendPostReq(String serverName) {
  if (WiFi.status() == WL_CONNECTED) {
    HTTPClient http;
    WiFiClientSecure client;

    client.setTimeout(15000);
    client.setFingerprint(fingerprint); //Veify encryption
    //client.setInsecure(); 
    // Specify the server and path for the POST request
    String host = serverName.substring(serverName.indexOf("://") + 3); // Remove "http://" or "https://"
    host = host.substring(0, host.indexOf('/'));

    //Timestamp
    unsigned long epochTime = timeClient.getEpochTime();


    String postData = "chipID=" + String(ESP.getChipId()) + 
                      "&coreVer=" + ESP.getCoreVersion() + 
                      "&flashID=" + String(ESP.getFlashChipId()) +
                      "&macAddr=" + WiFi.macAddress() +
                      "&temp=" + temp +
                      "&ts=" + String(timeClient.getFormattedTime());

    // Begin the HTTP request
    http.begin(client,serverName);
    http.addHeader("Content-Type", "application/x-www-form-urlencoded");
    
    if (WiFi.hostByName(host.c_str(), remote_ip)) {
    Serial.print("Fetching URL from: ");
    Serial.println(remote_ip);
  } else {
    Serial.println("DNS resolution failed");
  }


    // Send the HTTP POST request
    int httpCode = http.POST(postData);  // Send GET request

    // Check the HTTP response code
    if (httpCode > 0) {
      // If HTTP response is positive, print the result
      String payload = http.getString();  // Get the response payload
      Serial.println("GET Request successful!");
      Serial.println("Response: ");
      Serial.println(payload);  // Print the response body
      if (payload.equals("1")) {
        Serial.println("Turning on Fan....");
        // You can add your custom code here to handle when payload is "1"
        digitalWrite(D1,HIGH);
      } else {
        Serial.println("Turning off Fan...");
        digitalWrite(D1,LOW);
      }
    } else {
      // If the request fails
      Serial.println("POST request failed!");
      Serial.println("Error code: " + String(httpCode));
    }

    // End the HTTP connection
    http.end();
  } else {
    Serial.println("WiFi not connected");
  }
}

void loop() {
  server.handleClient();
  MDNS.update();
  timeClient.update();

  sendPostReq("https://log.suchana.infy.uk/fan.txt?i=1"); //Periodic POST request

  int numDevices = WiFi.softAPgetStationNum();
  //Serial.print("Number of devices connected: ");
  //Serial.println(numDevices);
}

Post request failed!
Error code: -1

I expect successful POST request to API endpoint. Endpoint will log the data in DB and return either 1 or 0 through with a DC motor can be controlled which is connected with GPIO 5 and GND.

EDIT: SSL certificate fingerprint is valid and accurate and has been cross-verified with Open SSL Command prompt.
openssl s_client -connect log.suchana.infy.uk:443 then openssl s_client -connect log.suchana.infy.uk:443 | openssl x509 -fingerprint -sha256 -noout

2

The fingerprint is a 20-byte SHA1 hash

    // Only check SHA1 fingerprint of certificate
    bool setFingerprint(const uint8_t fingerprint[20]) {
      return _ctx->setFingerprint(fingerprint);
    }
    bool setFingerprint(const char *fpStr) { return _ctx->setFingerprint(fpStr); }

not a 32-byte SHA256 hash. So use -fingerprint -sha1

3

@kenb4 Thanks. You solved the mystery. I've been using SHA256. I couldn't figure out where exactly the issue was. Even ChatGPT couldn't help me either. Now changing it into SHA1, it is working fine. Thanks a lot.