nRF7002DK and TLS Sockets -7100 error

RE: nRF7002DK and TLS Sockets -7100 error

Simonr — Tue, 14 Jan 2025 14:13:11 GMT

My colleague Amanda will handle your existing case. Please continue discussion there.

RE: nRF7002DK and TLS Sockets -7100 error

BrianW — Mon, 13 Jan 2025 15:54:50 GMT

The ticket for my diificulties getting a 'good' minimal TLS config on NCS2.8 is here:

nrf5340 NCS 2.8 cannot get TLS socket to load CA certif due to net_sock_tls / mbedtls error -0x262e

Any insight into a way to get a config that takes up minimal flash for TLS1.2 operation (equivalent to the zephyr 'pure' config in zephyr/modules/mbedtls/configs/config-mini-tls1_2.h) on NCS2.8 would be great!

RE: nRF7002DK and TLS Sockets -7100 error

Simonr — Mon, 13 Jan 2025 10:27:47 GMT

Hi Brian

Please note that a lot have changed in the last years, and NCS 2.8.0 was not out when Torbjørn made this reply, so there are a few things that likely have changed. If you're not able to find answers in this post. Please create a new ticket on DevZone, describing your problem in detail, and an engineer will be assigned and take a proper look.

Best regards,

Simon

RE: nRF7002DK and TLS Sockets -7100 error

BrianW — Fri, 10 Jan 2025 16:47:22 GMT

the NCS 2.8 documentation indicates that both CC3xx and Oberon backends are limited to 3K RSA keys in 'legacy' mode it seems:

https://docs.nordicsemi.com/bundle/ncs-2.8.0/page/nrf/libraries/security/nrf_security/doc/backend_config.html#rsa_configurations

and here it says in PSA type operation CC310 limited to 3K, but Oberon can do 4K!

Will attempt to try this...

RE: nRF7002DK and TLS Sockets -7100 error

BrianW — Fri, 10 Jan 2025 15:37:25 GMT

I have the same problem : but the change to the CC3XX isn't working for me (breaks the build) - I'm using NCS 2.8 - what version did you test on?

What is the Nordic recommendation to getting https to work? I would also note that the flash space required for mbedtls and associated code (wifi WPA supp for example) is bloated, and causing me serious issues on nrf5340.... A prj.conf 'minimal TLS 1.2' example that will work for 4K RSA certificate (very common on the web services now) would be very useful!

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Mon, 29 Jan 2024 09:13:05 GMT

Hi Gilles

The Oberon backend doesn't support key sizes larger than 3K, which is the reason this didn't work.

We have registered a ticket internally to add support for 4k keys, but exactly when this will happen is not yet known.

Best regards
Torbjørn

RE: nRF7002DK and TLS Sockets -7100 error

GilDev — Fri, 26 Jan 2024 12:38:10 GMT

Hi,

Any news about this matter?

Thanks!

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Fri, 07 Jul 2023 08:01:54 GMT

The Oberon backend seems to struggle with 4096 bit RSA operations, but unfortunately we won't really be able to look into this until the crypto experts are back from vacation over the summer.

In August most people should be back in office, and we will try to provide a more satisfactory conclusion to this issue.

Best regards
Torbjørn

RE: nRF7002DK and TLS Sockets -7100 error

nealjack — Thu, 06 Jul 2023 15:17:56 GMT

Can you update us when you figure out why the cryptocell backend works but the oberon one does not? I am currently unable to use the cryptocell backend due to a conflict with Openthread (see this issue), and am having the same issue with mbedtls (0x3b00) trying to parse a certificate.

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Mon, 03 Jul 2023 08:22:38 GMT

Great that you were able to get it working Eric 🙂

It seems you have both got it working then, and I will consider this case resolved.

Best regards
Torbjørn

RE: nRF7002DK and TLS Sockets -7100 error

erichotterbeefcurry — Thu, 29 Jun 2023 22:53:42 GMT

I was able to make HTTPS request too! I followed Kyle's steps where I had to convert my .pem to .der using openssh and I had to add an authroziation bearer token with my GET request, but I was able to correctly receive response from both Google and our internal server. Thanks Nordic folks for keep working on this!

RE: nRF7002DK and TLS Sockets -7100 error

Kyle1 — Thu, 29 Jun 2023 18:36:17 GMT

I ended up digging into it a little further, the cert needs to be the cert for the root CA and not for the domain, So i was able to get the cert for `DigiCertGlobalRootG2` which signed the `*.azurewebsites.net` certificate, converted it into the der format, using command mentioned above and now I get data back from the azure site.

RE: nRF7002DK and TLS Sockets -7100 error

Kyle1 — Thu, 29 Jun 2023 17:53:50 GMT

I've changed it to hit an azurewebsites.net domain instead of google.com and I am running into this issue

<err> net_sock_tls: TLS handshake error: -2700

I tried keeping the `globalsign_r1.der` then I tried to get the wildcard cert for `*.azurewebsites.net` and converetd it into a der from a pem with

`openssl x509 -in ./azurewebsites.pem -out azurewebsites.der -outform DER`

Updated CMakeList.txt and ca_certificate.h for the change in cert

But still got the -2700 error.

Is there any more information on how that .der certificate should be generated? is it site specific? of is this -2700 error something unrelated?

RE: nRF7002DK and TLS Sockets -7100 error

erichotterbeefcurry — Thu, 29 Jun 2023 16:32:31 GMT

Hi Torbjoin, ah ok I didn't realize the client request can return positive values too. Thank you and the team so much for working on top of this! Do you mind elaborating more on why I got the 301 request error, "Moved Permanently"? I suppose that meant we made a HTTPS connection to Google but something went wrong, and it sounds like Jeremy didn't get this request error.

-Best,

Eric

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Thu, 29 Jun 2023 10:38:52 GMT

Hi guys

Glad to hear you got it working Jeremy 🙂

The crypto experts are still discussing this. The assumption was that the CC312 backend did not support 4096 bit keys, and that is why the Oberon backend was enabled instead. It seems the CC312 do indeed support various 4096 bit key operations, it is just key generation that is limited to 3072 bits. Why Oberon doesn't work is not properly understood yet.

We might have to continue this discussion over the summer as a lot of people are on vacation at the moment, but we will try to get to the bottom of this eventually.

[quote user="libochengll"]but am still getting a http_client_req() failed?, err 40 (which is Lv3 Reset...?)[/quote]

I think this is just an inconsistency in the application. A positive return from the http_client_req() function is actually not an error, it just tells you how many bytes were returned. A negative value would indicate an error.

Best regards
Torbjørn

RE: nRF7002DK and TLS Sockets -7100 error

erichotterbeefcurry — Wed, 28 Jun 2023 21:25:05 GMT

Hi Jeremy, I tried using Tobjorn's updated prj.conf and the code from your wifi_zeph_2_4.zip but am still getting a http_client_req() failed?, err 40 (which is Lv3 Reset...?), with the http response saying "Moved Permanently", which is a 301 error. I'm wondering if you had to change anything from the zipped folder to make it work or did I do anything wrong?

-Eric

RE: nRF7002DK and TLS Sockets -7100 error

ATC-Jeremy — Wed, 28 Jun 2023 20:00:58 GMT

Hey Torbjørn,

This worked great for "google.com" with the provided cert! I'll verify this answer for now since this seems like it would help most people get up and running with TLS on the 7002. Unfortunately, we're still running into issues with our actual production webserver and certs, but at this point it could easily be a misconfiguration on our end.

Let us know if you guys figure out anything else (e.g. Why doesn't Oberon work? Do all of the supported ciphersuites work with CC3XX? etc), and we'll continue testing/reconfiguring on our end.

Thank you, this was a great step forward!

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Wed, 28 Jun 2023 07:21:32 GMT

Hi Jeremy

The hunt for a fix continues.

One of my colleagues was able to get TLS working by changing the crypto backend used from the Oberon backend to the CC3XX backend. We still don't quite understand why this fixes the issue, but I double checked that this worked on my end as well 😉

Could you give this a go?

Updated prj.conf below:

# WiFi Console Support.
CONFIG_EARLY_CONSOLE=y

# Network buffers
CONFIG_NET_MAX_CONTEXTS=6
CONFIG_NET_PKT_RX_COUNT=16
CONFIG_NET_PKT_TX_COUNT=16
CONFIG_NET_BUF_RX_COUNT=80
CONFIG_NET_BUF_TX_COUNT=80
CONFIG_NET_BUF_DATA_SIZE=512
CONFIG_HEAP_MEM_POOL_SIZE=120000
CONFIG_NET_TC_TX_COUNT=0

CONFIG_INIT_STACKS=y

CONFIG_NET_SHELL=y

CONFIG_NET_STATISTICS=y
CONFIG_NET_STATISTICS_PERIODIC_OUTPUT=n

# Networking
CONFIG_WIFI=y
CONFIG_WIFI_LOG_LEVEL_ERR=y
CONFIG_NET_L2_WIFI_SHELL=y
CONFIG_NET_CONFIG_SETTINGS=y
CONFIG_NETWORKING=y
CONFIG_NET_LOG=y
CONFIG_NET_IPV6=n
CONFIG_NET_IPV4=y
CONFIG_NET_UDP=y
CONFIG_NET_TCP=y
CONFIG_NET_DHCPV4=y

CONFIG_NET_IF_UNICAST_IPV4_ADDR_COUNT=1
CONFIG_NET_CONTEXT_SYNC_RECV=y

CONFIG_DNS_RESOLVER=y
CONFIG_JSON_LIBRARY=y

# Memories
CONFIG_MAIN_STACK_SIZE=8192
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096
CONFIG_NET_TX_STACK_SIZE=4096
CONFIG_NET_RX_STACK_SIZE=4096

CONFIG_IDLE_STACK_SIZE=640
CONFIG_ISR_STACK_SIZE=4096
CONFIG_SHELL_STACK_SIZE=4096

# Debugging
CONFIG_STACK_SENTINEL=y
CONFIG_DEBUG_COREDUMP=y
CONFIG_DEBUG_COREDUMP_BACKEND_LOGGING=y
CONFIG_DEBUG_COREDUMP_MEMORY_DUMP_MIN=y
CONFIG_SHELL_CMDS_RESIZE=n

CONFIG_NET_SOCKETS_LOG_LEVEL_DBG=y
CONFIG_NET_DEBUG_NET_PKT_ALLOC=y
CONFIG_NET_BUF_POOL_USAGE=y
CONFIG_MBEDTLS_DEBUG_C=y
CONFIG_MBEDTLS_DEBUG_LEVEL=4

# Logging
CONFIG_LOG=y
CONFIG_LOG_BUFFER_SIZE=2048
CONFIG_POSIX_CLOCK=y
#CONFIG_LOG_DEFAULT_LEVEL=4

# HTTP
CONFIG_HTTP_CLIENT=y

# Websockets Support.
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y
# TLS networking
CONFIG_POSIX_MAX_FDS=16
CONFIG_NET_SOCKETS_ENABLE_DTLS=n
CONFIG_NET_SOCKETS_TLS_MAX_CIPHERSUITES=16
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=6
CONFIG_TLS_CREDENTIALS=y

# mbed TLS and security
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=16384
CONFIG_MBEDTLS_HEAP_SIZE=128000
CONFIG_MBEDTLS_TLS_LIBRARY=y
CONFIG_MBEDTLS_X509_LIBRARY=y
CONFIG_MBEDTLS_PKCS1_V15=y
CONFIG_NRF_SECURITY_ADVANCED=y
CONFIG_NORDIC_SECURITY_BACKEND=y
CONFIG_PSA_WANT_ALG_SHA_1=y
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT=y
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
CONFIG_MBEDTLS_SSL_DEBUG_ALL=y
CONFIG_MBEDTLS_LOG_LEVEL_DBG=y
CONFIG_CC3XX_BACKEND=y
CONFIG_OBERON_BACKEND=n

CONFIG_MBEDTLS_DEBUG=n
#CONFIG_MBEDTLS_LOG_LEVEL_INF=y

CONFIG_MBEDTLS_SSL_RENEGOTIATION=y
CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
CONFIG_MBEDTLS_KEY_EXCHANGE_ALL_ENABLED=y
CONFIG_MBEDTLS_ECP_ALL_ENABLED=y
CONFIG_MBEDTLS_CIPHER_ALL_ENABLED=y
CONFIG_MBEDTLS_SSL_SESSION_TICKETS=y
CONFIG_MBEDTLS_SSL_CACHE_C=y
CONFIG_MBEDTLS_SSL_TICKET_C=y
CONFIG_PSA_WANT_ECC_TWISTED_EDWARDS_255=y
CONFIG_PSA_CRYPTO_DRIVER_ECC_TWISTED_EDWARDS_255_OBERON=y
CONFIG_MBEDTLS_RSA_C=y

# SNTP Support.
CONFIG_SNTP=y

# Glue - Fixes documented bugs in nRF7002 implementation.
CONFIG_WIFI_NRF700X=y
CONFIG_NET_L2_ETHERNET=y

# Include WPA Supplement. Requires POSIX_API & NET_SOCKETS.
CONFIG_WPA_SUPP=y

# Required to prevent error in \wifi\nrf700x\zephyr\src\shim.c:14:10: fatal error: sys/time.h: No such file or directory
CONFIG_NEWLIB_LIBC=y
CONFIG_NEWLIB_LIBC_NANO=n

# Required to prevent undefined reference to `z_impl_sys_rand32_get'
CONFIG_ENTROPY_GENERATOR=y
CONFIG_TEST_RANDOM_GENERATOR=y

# printing of scan results puts pressure on queues in new locking
# design in net_mgmt. So, use a higher timeout for a crowded
# environment.
CONFIG_NET_MGMT_EVENT_QUEUE_TIMEOUT=5000

CONFIG_DEBUG_THREAD_INFO=y
CONFIG_DEBUG_OPTIMIZATIONS=y

CONFIG_NET_TCP_WORKQ_STACK_SIZE=4096

Best regards
Torbjørn

RE: nRF7002DK and TLS Sockets -7100 error

ATC-Jeremy — Tue, 27 Jun 2023 13:51:08 GMT

Fantastic, thank you Torbjørn!

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Mon, 26 Jun 2023 20:28:52 GMT

Hi Jeremy

Thanks for sharing the code. There has been some sideways progress on my side (replacing one error for another), but nothing definite yet.

I made some changes to the project configuration based on input from a colleague:

# mbed TLS and security
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=16384
CONFIG_MBEDTLS_HEAP_SIZE=128000
CONFIG_MBEDTLS_TLS_LIBRARY=y
CONFIG_MBEDTLS_X509_LIBRARY=y
CONFIG_MBEDTLS_PKCS1_V15=y
CONFIG_NRF_SECURITY_ADVANCED=y
CONFIG_NORDIC_SECURITY_BACKEND=y
CONFIG_PSA_WANT_ALG_SHA_1=y
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT=y
CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN=y
CONFIG_MBEDTLS_SSL_DEBUG_ALL=y
CONFIG_MBEDTLS_LOG_LEVEL_DBG=y
#CONFIG_MBEDTLS_DEBUG=y
#CONFIG_MBEDTLS_DEBUG_C=y
CONFIG_MBEDTLS_SSL_RENEGOTIATION=y
CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
CONFIG_MBEDTLS_KEY_EXCHANGE_ALL_ENABLED=y
CONFIG_MBEDTLS_ECP_ALL_ENABLED=y
CONFIG_MBEDTLS_CIPHER_ALL_ENABLED=y
CONFIG_MBEDTLS_SSL_SESSION_TICKETS=y
CONFIG_MBEDTLS_SSL_CACHE_C=y
CONFIG_MBEDTLS_SSL_TICKET_C=y
CONFIG_PSA_WANT_ECC_TWISTED_EDWARDS_255=y
CONFIG_PSA_CRYPTO_DRIVER_ECC_TWISTED_EDWARDS_255_OBERON=y
CONFIG_MBEDTLS_RSA_C=y

CONFIG_NET_TCP_WORKQ_STACK_SIZE=4096

Now I get the 0x3b00 error instead (MBEDTLS_ERR_PK_INVALID_PUBKEY), as discussed in this case.

If I replace google.com with example.com I get 0x2700 (MBEDTLS_ERR_X509_CERT_VERIFY_FAILED).

In other words more work is needed. I will provide an update as soon as I have more to share.

Best regards
Torbjørn

RE: nRF7002DK and TLS Sockets -7100 error

ATC-Jeremy — Mon, 26 Jun 2023 12:56:20 GMT

Hi Eric,

Unfortunately we have not made any additional progress.

-Jeremy

RE: nRF7002DK and TLS Sockets -7100 error

erichotterbeefcurry — Fri, 23 Jun 2023 21:43:51 GMT

Hi Jeremy, I am experiencing the same problem too. I have a nrf7002DK and was able to get HTTP request working, but trying to add TLS and send HTTPS request gives me a 22 (EINVAL) error at connect(). Our code looks generally the same, so I assume we're in the same boat... Have you made any progress since posting? And please let me know if I can help you in any ways!

-Eric

RE: nRF7002DK and TLS Sockets -7100 error

ATC-Jeremy — Fri, 23 Jun 2023 17:28:42 GMT

Hey Torbjørn,

Sorry for the delay, I'm attaching a zipped project to this reply. I deleted the build directory to keep the size sane. We didn't have any additonal customizations to the build directory, so generating a new one on your end shouldn't make a difference hopefully. There's no company specific info or private keys/certs, so I shouldn't get into any trouble sharing this haha.

devzone.nordicsemi.com/.../wifi_5F00_zeph_5F00_2_5F00_4.zip

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Tue, 20 Jun 2023 13:10:52 GMT

Hi again

Is there any chance you could share your project with me so I can test it here?

It seems we don't have any proper HTTPS examples internally. I hope we can provide one soon enough, but I doubt we will be able to get a proper one together until after the summer.

Best regards
Torbjørn

RE: nRF7002DK and TLS Sockets -7100 error

ovrebekk — Fri, 16 Jun 2023 08:01:19 GMT

Hi Jeremy

I will try to reproduce your issue locally and see what might be the cause of the problem, but I will need a bit more time. I will do my best to get back to you on Monday with an update.

If there are any updates on your end in the mean time please let me know.

Best regards
Torbjørn