• State Not Answered
  • Replies 12 replies
  • Subscribers 95 subscribers
  • Views 1639 views
  • Users 0 members are here
Attachments (1) Download All
Nordic Case Info
  • Case ID: 327289
Options

nRF9161 - Ciphersuites sample - example.com refuses all Ciphersuites.

sam_mack

Running the Ciphersuites sample code on the nRF9161 I get Connection Refused on all attempted ciphersuites. Including after adding the CONFIG_EXTENDED_CIPHERSUITE_LIST=y to the prj.conf.

*** Booting nRF Connect SDK d96769faceca ***
TLS Ciphersuites sample started
Certificate mismatch
Provisioning certificate
Waiting for network.. OK
Trying all ciphersuites to find which ones are supported...
Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_PSK_WITH_AES_256_CBC_SHA
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_PSK_WITH_AES_128_CBC_SHA256
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_PSK_WITH_AES_128_CBC_SHA
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_PSK_WITH_AES_128_CCM_8
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_EMPTY_RENEGOTIATIONINFO_SCSV
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Connecting to example.com... connect() failed, err: 111, Connection refused
Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Connecting to example.com... connect() failed, err: 111, Connection refused

Ciphersuite support summary for host `example.com`:
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: No
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: No
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: No
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: No
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: No
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: No
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: No
TLS_PSK_WITH_AES_256_CBC_SHA: No
TLS_PSK_WITH_AES_128_CBC_SHA256: No
TLS_PSK_WITH_AES_128_CBC_SHA: No
TLS_PSK_WITH_AES_128_CCM_8: No
TLS_EMPTY_RENEGOTIATIONINFO_SCSV: No
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: No
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: No
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: No

Finished.

  • 0 in reply to sam_mack

    Hi,

    It is great to hear that you got it working. Thank you for providing the update.

    Best regards,
    Dejan

  • 0 in reply to dejans

    This continues not to work consistently. Today the same code does not send a TLS Hello and just sends a TPC FIN after the TCP SYN ACK handshaking.

    Is there a way to get more verbose logging for TCP/TLS issues? There is no indication of what is going wrong.

  • 0 in reply to sam_mack

    Hi,

    Is your issue consistently reproducible on the nrf9161-dk?

    Have you made any changes to the default cipher suites sample?

    Have you tried to use another nrf9161-dk board?

    Best regards,
    Dejan

  • 0 in reply to dejans

    Yes, it's consistent on the nrf9161. I also have a nRF9151 DK that does not work as well, but I do not have more nRF9161-DKs. 

    I am also doing this work in a workspace not in tree.

    This morning, I  "create a new application" select "copy a sample" and select "TLS cipher suite", then add the nRF9161dk build config and build. This fails in the same way (however without modem tracing). All connections are refused. 

    Toolchain and SDK are both set to v2.6.1

    Below is the 

    [Sec Thread] Secure image initializing!
    TF-M isolation level is: 0x00000001
    Booting TF-M v2.0.0
    *** Booting nRF Connect SDK 3758bcbfa5cd ***
    TLS Ciphersuites sample started
    Certificate mismatch
    Provisioning certificate
    Waiting for network.. OK
    Trying all ciphersuites to find which ones are supported...
    Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_PSK_WITH_AES_256_CBC_SHA
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_PSK_WITH_AES_128_CBC_SHA256
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_PSK_WITH_AES_128_CBC_SHA
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_PSK_WITH_AES_128_CCM_8
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_EMPTY_RENEGOTIATIONINFO_SCSV
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    Connecting to example.com... connect() failed, err: 111, Connection refused
    Trying ciphersuite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    Connecting to example.com... connect() failed, err: 111, Connection refused

    Ciphersuite support summary for host `example.com`:
    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: No
    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: No
    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: No
    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: No
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: No
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: No
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: No
    TLS_PSK_WITH_AES_256_CBC_SHA: No
    TLS_PSK_WITH_AES_128_CBC_SHA256: No
    TLS_PSK_WITH_AES_128_CBC_SHA: No
    TLS_PSK_WITH_AES_128_CCM_8: No
    TLS_EMPTY_RENEGOTIATIONINFO_SCSV: No
    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: No
    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: No
    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: No

    Finished.

    I've also uploaded the modem trace.

    trace-2024-05-28T12-51-10.831Z.mtrace

  • 0 in reply to sam_mack

    Hi,

    Thank you for additional information and modem trace.

    I have replicated your issue. We will further look into it. I will get back to you with new information, probably by the end of this week.

    Best regards,
    Dejan

Related
Terms of service