RE: NRF SDK supported TLS/SSL algorithms

Øyvind — Tue, 20 Jun 2023 07:24:56 GMT

Hello,

Are you able to share some information on what modem FW and SDK version you are running? Assuming it is the same as in case 305164.

Here are the limitations of modem FW v1.3.1

*** Limitations
***************
- TLS/DTLS
- Up to three simultaneous TLS/DTLS connections are possible.
- Maximum server certificate chain size has a limit of 4kB.
- Server certificate expiry time is not verified.
- pkcs#8 is not supported.
- Absolute maximum number of supported credentials is 32. The actual amount depends on size of
credentials as memory area reserved for credentials may be a limiting factor as well.
- DTLS supports PSK authentication only.
- 2kB secure socket buffer size.
- Maximum number of raw sockets is 4.
- It is recommended to free the modem resources by closing unused network sockets.
- User plane data is supported in Cat M1 mode only.
- TLS is not supported when socket is configured to TCP server mode.
- Support for Non-IP Data Delivery (NIDD). Feature is verified only for NB-IoT and LTE-M is not
supported.
- The amount of ownership keys is restricted to one. Multiple instances are not allowed. Starting
from mfw_nrf9160_1.3.1, it is not allowed to write ownership key with AT%CMNG AT command. As this
change introduces incompatibility between older modem firmware versions, it is recommended to pay
special attention to this change.
- Downgrading to older modem firmware
- Keys and certificates written with credential storage management AT commands might get erased
if older than mfw_nrf9160_1.3.0 modem firmware version is downgraded to a device. If
downgrading, it is compulsory to check existence of keys and possibly re-write erased keys and
certificates.
- AT command configurations written and stored to a non-volatile memory will get erased from the
memory if old modem firmware is downgraded to a device and that old version does not support
the AT commands.

The issue might be the certs length. If the certificates are from a web server these are often larger than what our device support.

The error 104 could be

#define ECONNRESET 104 /**< Connection reset by peer */

But I will need more logs and a modem trace in order to know what exactly is the issue here.

Kind regards,
Øyvind