nRF Connect SDK v2.6.1 - https_client works for example.com but not other hosts such as google.com

[jchen2024]

With nRF7002DK and TF-M (nrf7002dk_nrf5340_cpuapp_ns.conf) configuration, the sample project works for example.com:

*** Booting nRF Connect SDK v3.5.99-ncs1-1 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Connecting to the network
[00:00:04.949,981] <inf> wifi_mgmt_ext: Connection requested
[00:00:09.183,044] <inf> net_dhcpv4: Received: 192.168.101.16
Network connectivity established and IP address assigned
Looking up example.com
Resolved 93.184.215.14 (AF_INET)
Connecting to example.com:443
Sent 61 bytes
Received 377 bytes

> HTTP/1.1 200 OK

Finished, closing socket.
Network connectivity lost
Disconnected from the network

However, replace the host with google.com and its associated CA:

[00:00:45.647,186] <inf> wifi_mgmt_ext: Connection requested
[00:00:49.878,845] <inf> net_dhcpv4: Received: 192.168.101.16
Network connectivity established and IP address assigned
Looking up google.com
Resolved 142.250.191.206 (AF_INET)
Connecting to google.com:443
connect() failed, err (22): Invalid argument
Network connectivity lost
Disconnected from the network

[jchen2024]

I reviewed a similar question for an older version:  Cannot use the https_client sample with a hostname other than example.com . Was there a fix for that. Should I try non TF-M build and replace the default cipher suite?

[runsiv]

Hi  Ji

I'm looking into your issue and will get back to you tomorrow when I have had the time to look into it

Regards

Runar

[runsiv]

Hi 

On my end I only got error 113 so i need to dig a bit more

Regards

Runar

[jchen2024]

Here excerpts from the unified diff my changes in main.c:

/* Null terminate certificate if running Mbed TLS on the application core.
* Required by TLS credentials API.
@@ -133,7 +190,7 @@ int tls_setup(int fd)
REQUIRED = 2,
};

- verify = REQUIRED;
+ verify = NONE;

@@ -295,6 +352,12 @@ clean_up:
int main(void)
{
int err;
+ struct timeval tv;
+
+ // tv.tv_sec = (long long)1720188274;
+ tv.tv_sec = (long long)1720630997;
+
+ clock_settime(CLOCK_REALTIME, &tv);

I added the set time to make sure that the date is good for the certificates if it is used.

[runsiv]

Hi

Could you try change from google.com to www.google.com?

Regards

Runar

[jchen2024]

Yes. With www.google.com. I got 200 OK:

*** Booting nRF Connect SDK v3.5.99-ncs1-1 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Connecting to the network
[00:00:04.977,996] <inf> wifi_mgmt_ext: Connection requested
[00:00:09.221,099] <inf> net_dhcpv4: Received: 192.168.101.16
Network connectivity established and IP address assigned
Looking up www.google.com
Resolved 142.250.191.196 (AF_INET)
Connecting to www.google.com:443
Sent 64 bytes
Received 1091 bytes

> HTTP/1.1 200 OK

Finished, closing socket.
Network connectivity lost
Disconnected from the network

[jchen2024]

It is great to be able to connect to Google.com with tls sockets. When I try connecting to amazon or auth0, the connection still failed. It may have something to do with the encryption algorithms or cipher suites. Both google.com and example.com uses "PKCS #1 SHA-256 With RSA Encryption" for certification signature, auth0 uses "X9.62 ECDSA Signature with SHA-384". 

[runsiv]

jchen2024 said:

Yes. With www.google.com. I got 200 OK:

That is good

jchen2024 said:

auth0 uses "X9.62 ECDSA Signature with SHA-384

You could try with the Kconfig flag https://docs.nordicsemi.com/bundle/ncs-latest/page/kconfig/index.html#CONFIG_PSA_WANT_ALG_SHA_384 

Regards

Runar