nRF Connect SDK v2.6.1 - https_client works for example.com but not other hosts such as google.com

[jchen2024]

With nRF7002DK and TF-M (nrf7002dk_nrf5340_cpuapp_ns.conf) configuration, the sample project works for example.com:

*** Booting nRF Connect SDK v3.5.99-ncs1-1 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Connecting to the network
[00:00:04.949,981] <inf> wifi_mgmt_ext: Connection requested
[00:00:09.183,044] <inf> net_dhcpv4: Received: 192.168.101.16
Network connectivity established and IP address assigned
Looking up example.com
Resolved 93.184.215.14 (AF_INET)
Connecting to example.com:443
Sent 61 bytes
Received 377 bytes

> HTTP/1.1 200 OK

Finished, closing socket.
Network connectivity lost
Disconnected from the network

However, replace the host with google.com and its associated CA:

[00:00:45.647,186] <inf> wifi_mgmt_ext: Connection requested
[00:00:49.878,845] <inf> net_dhcpv4: Received: 192.168.101.16
Network connectivity established and IP address assigned
Looking up google.com
Resolved 142.250.191.206 (AF_INET)
Connecting to google.com:443
connect() failed, err (22): Invalid argument
Network connectivity lost
Disconnected from the network

[jchen2024]

I reviewed a similar question for an older version:  Cannot use the https_client sample with a hostname other than example.com . Was there a fix for that. Should I try non TF-M build and replace the default cipher suite?

[runsiv]

Hi  Ji

I'm looking into your issue and will get back to you tomorrow when I have had the time to look into it

Regards

Runar

[jchen2024]

Thanks for the suggestion! The error has changed to this:

[00:00:02.171,966] <inf> wifi_mgmt_ext: Connection requested
[00:00:06.409,637] <inf> net_dhcpv4: Received: 192.168.101.16
Network connectivity established and IP address assigned
Looking up google.com
Resolved 142.250.191.206 (AF_INET)
Connecting to google.com:443
Sent 60 bytes
Received 631 bytes

> HTTP/1.1 301 Moved Permanently

Finished, closing socket.
Network connectivity lost
Disconnected from the network

Not sure why google.com is not happy about the HEAD message, which is typically just show the response size for GET. What response did you get?

[runsiv]

Hi 

On my end I only got error 113 so i need to dig a bit more

Regards

Runar

[jchen2024]

Here excerpts from the unified diff my changes in main.c:

/* Null terminate certificate if running Mbed TLS on the application core.
* Required by TLS credentials API.
@@ -133,7 +190,7 @@ int tls_setup(int fd)
REQUIRED = 2,
};

- verify = REQUIRED;
+ verify = NONE;

@@ -295,6 +352,12 @@ clean_up:
int main(void)
{
int err;
+ struct timeval tv;
+
+ // tv.tv_sec = (long long)1720188274;
+ tv.tv_sec = (long long)1720630997;
+
+ clock_settime(CLOCK_REALTIME, &tv);

I added the set time to make sure that the date is good for the certificates if it is used.

[runsiv]

Hi

Could you try change from google.com to www.google.com?

Regards

Runar

[jchen2024]

Yes. With www.google.com. I got 200 OK:

*** Booting nRF Connect SDK v3.5.99-ncs1-1 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Connecting to the network
[00:00:04.977,996] <inf> wifi_mgmt_ext: Connection requested
[00:00:09.221,099] <inf> net_dhcpv4: Received: 192.168.101.16
Network connectivity established and IP address assigned
Looking up www.google.com
Resolved 142.250.191.196 (AF_INET)
Connecting to www.google.com:443
Sent 64 bytes
Received 1091 bytes

> HTTP/1.1 200 OK

Finished, closing socket.
Network connectivity lost
Disconnected from the network

[jchen2024]

It is great to be able to connect to Google.com with tls sockets. When I try connecting to amazon or auth0, the connection still failed. It may have something to do with the encryption algorithms or cipher suites. Both google.com and example.com uses "PKCS #1 SHA-256 With RSA Encryption" for certification signature, auth0 uses "X9.62 ECDSA Signature with SHA-384". 

[runsiv]

jchen2024 said:

Yes. With www.google.com. I got 200 OK:

That is good

jchen2024 said:

auth0 uses "X9.62 ECDSA Signature with SHA-384

You could try with the Kconfig flag https://docs.nordicsemi.com/bundle/ncs-latest/page/kconfig/index.html#CONFIG_PSA_WANT_ALG_SHA_384 

Regards

Runar