Key Exchange issue

[Randall]

I'm communicating with my customers website through a certificate and key provided by an OAUTH process.  I'm posting data to the website successfully by adding those certs to my TLS Credentials

   err = tls_credential_add( TLS_SEC_TAG,

                             TLS_CREDENTIAL_SERVER_CERTIFICATE,

                             certPtr,

                             strlen(certPtr) + 1);

   if ( err ) LOG_ERR( "Error adding GET_CLOUD_CERT" );

   param_read( PARAM_REPO_CLOUD_KEY, keyPtr, CLOUD_KEY_LEN );

   err = tls_credential_add( TLS_SEC_TAG,

                             TLS_CREDENTIAL_PRIVATE_KEY,

                             keyPtr,

                             strlen(keyPtr) + 1);

   if ( err ) LOG_ERR( "Error adding GET_CLOUD_KEY" );

   err = tls_credential_add( TLS_SEC_TAG,

                             TLS_CREDENTIAL_CA_CERTIFICATE,

                             oauth_root_ca,

                             strlen(oauth_root_ca) + 1);

I'm posting this to their site device-dev.get-cloud.com

Another process that I need to implement is to renew the keys when they are close to expiration.  To do this I need to send a GET request to auth.get-cloud.com using the same cert and key pair.

This is failing on my device.  It does work if I use curl;

curl -vv --key key.pem --cert cert.pem https://auth.get-cloud.com/renew 

So I'm thinking that authentication with the cert/key is working but the key exchange is not.  I've tried enabling every exchange option that I can find;

CONFIG_NET_SOCKETS_SOCKOPT_TLS=y

# TLS configuration

CONFIG_MBEDTLS=y

CONFIG_MBEDTLS_BUILTIN=y

CONFIG_MBEDTLS_ENABLE_HEAP=y

CONFIG_MBEDTLS_HEAP_SIZE=60000

CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=8096

CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT=y

#CONFIG_MBEDTLS_USER_CONFIG_FILE="mbedtls_config.h"

CONFIG_MBEDTLS_ECP_ALL_ENABLED=y

CONFIG_MBEDTLS_ECP_C=y

CONFIG_MBEDTLS_ECDSA_C=y

CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED=y

CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED=y

CONFIG_MBEDTLS_ECP_DP_BP384R1_ENABLED=y

CONFIG_MBEDTLS_ECP_DP_BP512R1_ENABLED=y

CONFIG_MBEDTLS_HASH_SHA512_ENABLED=y

CONFIG_MBEDTLS_SERVER_NAME_INDICATION=y

CONFIG_MBEDTLS_DEBUG=n

CONFIG_MBEDTLS_ECDH_C=y

CONFIG_MBEDTLS_SHA1_C=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED=y

But nothing works.  Some things seem to be out of my range because I'm using MBEDTLS_BUILTIN.  Some options seem to call for NRF_SECURITY or L2_OPENTHREAD.  I'm concerned that trying to move to any of that will cause problems with my existing setup.  I was hoping that you might be able to think of some things I can try.

[Randall]

The person that posted the issue on the Azure github seems to think it's a bug.  I guess Microsoft doesn't agree as they haven't done anything to address it.  So if there is a way to get Zephyr to offer up the certificate on it's own, that would be great.  If not, I may be stuck unless the cloud provider offers me an alternate way to renew keys.

Thanks,

[Sigurd Hellesvik]

I think first, it would be good to have a closer look into this, maybe we can get some new info.

Can you get a wireshark sniffer log from the error you get?

Do you get UART logs from the device when it fails?
Try to turn on mbedlts logging and see if you get more info then.

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y

CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED=y

I see that you have enabled 10 options while CONFIG_MBEDTLS_KEY_EXCHANGE_ALL_ENABLED selects 11. Off-chance, but maybe you are missing the last one?

[Randall]

The only one missing is ECJPAKE.  Doubted that key juggling is something that Microsoft is doing but I tried it anyway.  And it still doesn't work.  I can't really do wireshark since I'm using a cell modem.  The cloud team did with a Linux-based Zephyr setup and it basically shows that the certificate isn't being sent to the authorization server.  I tried to enable MBEDTLS debugging, but the level keeps getting set to 0.  I tried to hard wire it with CONFIG_MBEDTLS_DEBUG_LEVEL but I didn't get any debug and looking it autoconf.h it's still set to 0.  So something in the build is hard wiring it to 0 and I don't know what it is.

[Sigurd Hellesvik]

Try CONFIG_MBEDTLS_DEBUG?

[Randall]

One has to set CONFIG_MBEDTLS_DEBUG to y before setting the debug level will not trigger an error.  So yes, I've already set that config to y.

Do you know anything about TLS 1.3 support in Zephyr?