Modem error when provisioning large certificate?

Question

I'm using a modified "HTTPS client sample" from nrf/samples/net/https_client in ncs v2.6.1 on the nrf9160dk board. The base example worked great and I am able to perform the request on every processor reset, however, when I change the request structure and the certificate to hit my owm REST endpoint, it works the first time when I just flash it and comes back with a 400 error (I'm guessing I have some header wrong or something, but the connection seems to be working). However, on the second boot I get errors and nothing works from there. To recover the device, I need to flash the at_client onto it and manually use AT%CMNG=3,<sec_tag>,<type> to remove the certificate I used, before it will allow me to flash another https client and make a request.

The certificate i'm using is significantly larger than the original one in the example, so I had to change the BUILD_ASSERT(sizeof(cert) < KB(4), "Certificate too large"); to KB(8) instead. as the certificate is about 7069 bytes.

The certificate I'm using looks exactly like this: (I'm not sure what is sensetive here, so I replaced all content with "x" but the structure is unchanged)

The trace output for the first and second boot looks like this: (I redacted some sensetive information like the host ip)

###### FIRST BOOT ######
*** Booting nRF Connect SDK v3.5.99-ncs1-1 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate with retries
Provisioning certificate
Certificate mismatch
Connecting to the network
+CEREG: 2,"36C5","0279360C",7
+CSCON: 1
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
+CEREG: 5,"36C5","0279360C",7,,,"11100000","11100000"
Network connectivity established and IP address assigned
Looking up vekdgoqxnqqyqghhpcmr.net
Resolved XXX.XXX.XXX.XXX (AF_INET)
Connecting to XXXXXXXXXXXX.net:443

Sent 311 bytes
Received 1263 bytes

>        HTTP/1.1 400 Bad Request

Finished, closing socket.
+CGEV: ME PDN DEACT 0
+CEREG: 0
+CGEV: ME DETACH
+CSCON: 0
Network connectivity lost
Disconnected from the network





###### SECOND BOOT ######
*** Booting nRF Connect SDK v3.5.99-ncs1-1 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate with retries
Provisioning certificate
[00:00:00.577,606] <err> nrf_modem_lib_netif: Modem error: 0x4, PC: 0xecb64
[00:00:00.577,667] <err> lte_lc: Failed to set functional mode. Please check XSYSTEMMODE.
[00:00:00.577,667] <err> nrf_modem_lib_netif: lte_lc_func_mode_set, error: -14
Fatal error received from the connectivity layer
Certificate mismatch
[00:00:00.577,789] <wrn> modem_key_mgmt: Failed to retrieve CMEE status, err -1
Failed to delete existing certificate, err -1
[00:00:00.577,880] <wrn> modem_key_mgmt: Failed to retrieve CMEE status, err -1
Failed to provision certificate, err -1
Provisioning certificate
[00:00:02.578,063] <wrn> modem_key_mgmt: Failed to retrieve CMEE status, err -1
Failed to check for certificates err -1
Provisioning certificate
[00:00:04.578,247] <wrn> modem_key_mgmt: Failed to retrieve CMEE status, err -1
Failed to check for certificates err -1
Failed to provision certificate after retries, err -1

Hakon · Accepted Answer

Anders Reiche said: Or are you saying that there is a devacademy sample that uses a modem firmware without this limit? 
 No, the devacademy sample will be updated to use a shorter certificate. The limit will still be the same. 
 Anders Reiche said: Are you saying that the 4Kb server certificate limit in the modem firmware is a permanent limit that will not be changed? 
 Yes.

Modem error when provisioning large certificate?

Top Replies