Where can I find cert.pem and key.pem?

[TheTechRobo]

I've been circumventing the cettificate addition but a few months ago (before it was added) I got an error in the WSC after changing the DNS and I suspect it's because HTTPS.

Thanks!

[spotlightishere]

Unfortunately a tricky question to answer. 😅

The EC component of the Wii Shop Channel uses the IOS SSL trust store, which by default is only Nintendo's CA. The main storefront as provided via Opera has its own trust store within the main ARC -> opera/opcacrt6.dat, only holding Nintendo's. Modifying Opera's trust store can be done via Opera on the desktop as well, which makes life a lot easier!

Our solution for IOS has been to hardcode our own certificate into the binary, patch WSC to load the cert to IOS, and go from there. However, this requires a specified length of a CA, and we've not even released our patches to the shop for things to function.

After some discussion with everyone, we think the best solution is to create a patcher to automate generating a certificate and inserting it, alongside separating other patches we've made along the way for others to review and modify. See WSC-Patcher for progress as we make this.

---

In the meantime - if you're interested in only the storefront, you'll need a 1024-bit CA with SHA-1 as the algorithm (SHA-256 will heavily break things, sadly.) I highly recommend utilizing Opera 9 on Windows to insert your own - you can copy and paste opcacrt6.dat from its place within %APPDATA%.
With Dolphin, you can disable SSL certificate verification to toy with EC as well.

Let me know if you have any questions, I'd love to help!

[spotlightishere]

Pretty much regarding mitm - the server presents a certificate, and it's up to the client to accept or reject. Most devices have a CA list (say from Mozilla's trust store) where certificates presented can be verified against. Here Nintendo chose to only have their own, and we're overriding theirs with ours.

For the WAD - you can use a tool like Sharpii or ShowMiiWads to extract its contents.

The main binary, most likely showing as 0000005e.app or 00000001.app, is LZ11 compressed - you can use lzx with lzx -d <app name>. You don't have to recompress it to repack in the WAD, and usually it makes editing a lot harder that way :P Decompressed, it's about 3.5 MB, if that helps to check if things are right. This is wrong - it's not decompressed! I had another channel in mind when writing this, I'm sorry to confuse if it did.

The main ARC can be extracted using ShowMiiWads directly iirc or via wszst, whichever works best. Its name is 0000005f.app and is about 3.4 MB, slightly smaller than the main binary.

You don't have to keep the WAD or the ARC the same size, but you do need to keep the binary the same size. Make sure that edits aren't longer than their original there - Nintendo uses str* for practically all of their string operations, so you can null pad your domains to fit if needed.

[TheTechRobo]

Wait - so I don't have to recompress it? Why does that make editing harder?

Also, wszst doesn't seem to allow compressing RARC, which I assume is an ARC?

[spotlightishere]

You don't have to decompress the dol specifically - it's a lot easier for quick changes as it's not required to compress. (Feel free to ignore if it helps out!)

I think wszst also calls calls an arc an U8 archive. wszst x 0000005f.app should work to extract, and then wszst c 0000005f.d from the resulting folder to create once more.

[TheTechRobo]

????

Sorry for having so many problems. This is probably so annoying for you :/

[spotlightishere]

No worries at all! I should have been more specific - 0000005f.app is how it's installed to NAND (its content ID). Its
index as Sharpii or similar might unpack it is 00000002.app.

[spotlightishere]

Hey, I wanted to share that we now have a complete patcher utility available to automate provisioning a certificate, patching, and creating a usable WAD. If you get a chance, please give it a try and file issues!

https://github.com/OpenShopChannel/WSC-Patcher

[TheTechRobo]

Sure, thanks! I kept procrastinating your instructions - I hadn't even repacked the WAD yet, and I haven't had my PC available for a while. Now I'm going to try that instead, thanks! :D

[TheTechRobo]

Hi, I just tried it. I copied server.key into WSC-Web's working dir as key.pem and server.pem, cert.pem. But when I python3 app.py I get ssl.SSLError: [X509: KEY_VALUES_MISMATCH] key values mismatch (_ssl.c:4065). This is probably a stupid question, but how do I fix this? Thank you very much!

[spotlightishere]

Thank you for catching that, I was able to reproduce this locally - seems something changed during development, producing invalid keys 😬 I created WSC-Patcher#2 to track this.

In the meantime, you can create your own certificate via the openssl commands above, placing the root certificate in the output folder in DER form (i.e. openssl x509 -pubout -outform DER -in osc-ca.pem). See the WSC-Patcher README for more info there!