MBEDTLS time/date support with nRF Security

RE: MBEDTLS time/date support with nRF Security

dejans — Fri, 17 Oct 2025 13:37:39 GMT

Hi Charles,

We are still looking into this issue. Unfortunately, I cannot provide exact timeline when this issue might get resolved. I will get back to you as soon as I have an update. I will keep this ticket open until then.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

c.lancea — Fri, 10 Oct 2025 13:25:48 GMT

Hello,

Thank you for the update.

Best regard,
Charles

RE: MBEDTLS time/date support with nRF Security

dejans — Fri, 10 Oct 2025 13:03:26 GMT

Hi,

This is just to inform you that we are still looking into this issue. I expect to get back to you by the end of next week but please note that it might take more time than usual for this issue to get resolved.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

dejans — Wed, 08 Oct 2025 09:16:57 GMT

Hi,

[quote user="c.lancea"]Do you have any other suggestion ? [/quote]

We will look into this internally. I expect to get back to you with status update by the end of the week.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

c.lancea — Tue, 07 Oct 2025 09:50:35 GMT

Hello,

Modifying directly the sdk is not an option for us. We use the sdk though nrf connect vs code extension, so it's is not in our repository. Also our build machine has another installation that we would need to modify.
Those two point alone makes it impossible or a very bad practice which would be impossible to maintain.

Do you have any other suggestion ?
Is the tls date time verification planned for another release ?

Thanks

RE: MBEDTLS time/date support with nRF Security

dejans — Tue, 07 Oct 2025 09:37:34 GMT

Hi c.lancea ,

You could try to add changes from previously mentioned PR manually.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

c.lancea — Mon, 06 Oct 2025 15:22:32 GMT

Hello,

Sorry to revive this post, but I am facing the same issues.

The PR mentioned to enable the usage of TLS DATE_TIME was never merged and is now closed.

Is there another way to have tls date time validation for NCS 3.0.2 without "MBEDTLS_BUILTIN" ?

Thanks

RE: MBEDTLS time/date support with nRF Security

dejans — Thu, 30 Jan 2025 13:50:30 GMT

Hi,

We have looked further into checking certificate expiration date. Please have a look at this PR which enables usage of TLS DATE_TIME into the config system. It should work for both legacy APIs and PSA APIs.

To enable DATE/TIME checking, try to enable these Kconfig options

CONFIG_DATE_TIME=y
CONFIG_MBEDTLS_HAVE_TIME_DATE=y

and set date/time in the code

#include "date_time.h"

...

// Setting year to 2035, which is past certificate expiration date -> SSL alert number 45
struct tm new_date_time = {0,0,0,1,0,135,0,0,0};
(void) date_time_set(&new_date_time);

...

The changes were tested using crypto psa_tls sample in sdk-nrf. struct tm can be found in this reference.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

dejans — Thu, 30 Jan 2025 10:37:40 GMT

Hi,

No, not yet, but I have reached out to our developers. I am aware that looking into this takes longer time than initially expected. I am sorry for any inconvenience this might cause. Although it is difficult to give any estimate on resolution at this point, I expect to get back to you again in several weeks (possibly earlier if there is any update on this). Thank you for your patience.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

Ligo George — Wed, 29 Jan 2025 06:16:41 GMT

Hi dejans ,

Did you get any update on this ?

RE: MBEDTLS time/date support with nRF Security

dejans — Wed, 20 Nov 2024 09:42:06 GMT

Hi,

We will further look into the possibility for mbedtls to check certificate expiration date. I expect to get back to you with new information probably within next few weeks.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

Ligo George — Mon, 18 Nov 2024 17:16:34 GMT

For e.g. we can check, if the time is not set the default time will be wrong (start of epoch). The certificates are not valid from epoch start. Or simply by setting a future time where the certificate is expired.

RE: MBEDTLS time/date support with nRF Security

dejans — Mon, 18 Nov 2024 17:07:16 GMT

Hi,

Can you provide information on how you tried to check certificate expiry?

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

Ligo George — Fri, 15 Nov 2024 12:47:22 GMT

We get time from internet and update the system time using Zephyr time utils and time is running fine.

It looks like the certificate expiry checks are not working since MBEDTLS_HAVE_TIME_DATE is not supported.

RE: MBEDTLS time/date support with nRF Security

dejans — Fri, 15 Nov 2024 12:36:20 GMT

Hi,

Could you provide information on how your project acquires time and how time is kept synchronized?

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

Ligo George — Tue, 12 Nov 2024 08:57:32 GMT

Does it mean that it is not possible to check expiry of certificates ?

RE: MBEDTLS time/date support with nRF Security

dejans — Thu, 03 Oct 2024 11:16:22 GMT

Hi,

PSA Crypto does not support TIME_DATE. For now, legacy option must be used.

Best regards,
Dejan

RE: MBEDTLS time/date support with nRF Security

Ligo George — Wed, 02 Oct 2024 12:06:42 GMT

This is a generic issue with nRF SDK, not tied to an application.

I am using v2.7.0 SDK.

For e.g. you can try building "aws_iot_mqtt" example on nRF7002DK. See the build log for the same below.

Building aws_iot_mqtt
west build --build-dir /home/vscode/workspaces/base-station-application/aws_iot_mqtt/build /home/vscode/workspaces/base-station-application/aws_iot_mqtt --pristine --board nrf7002dk/nrf5340/cpuapp/ns -- -DNCS_TOOLCHAIN_VERSION=NONE -DBOARD_ROOT=/home/vscode/workspaces/base-station-application

-- west build: generating a build system
Loading Zephyr default modules (Zephyr base).
-- Application: /home/vscode/workspaces/base-station-application/aws_iot_mqtt
-- CMake version: 3.30.2
-- Found Python3: /usr/bin/python3 (found suitable version "3.10.12", minimum required is "3.8") found components: Interpreter
-- Cache files will be written to: /home/vscode/workspaces/.cache/zephyr
-- Zephyr version: 3.6.99 (/home/vscode/workspaces/external_dependencies/zephyr)
-- Found west (found suitable version "1.2.0", minimum required is "0.14.0")
-- Board: nrf7002dk, qualifiers: nrf5340/cpuapp/ns
-- Found host-tools: zephyr 0.16.5 (/home/vscode/workspaces/external_dependencies/zephyr-sdk)
-- Found toolchain: zephyr 0.16.5 (/home/vscode/workspaces/external_dependencies/zephyr-sdk)
-- Found Dtc: /usr/bin/dtc (found suitable version "1.6.1", minimum required is "1.4.6")
-- Found BOARD.dts: /home/vscode/workspaces/external_dependencies/nrf/boards/nordic/nrf7002dk/nrf7002dk_nrf5340_cpuapp_ns.dts
-- Generated zephyr.dts: /home/vscode/workspaces/base-station-application/aws_iot_mqtt/build/zephyr/zephyr.dts
-- Generated devicetree_generated.h: /home/vscode/workspaces/base-station-application/aws_iot_mqtt/build/zephyr/include/generated/devicetree_generated.h
-- Including generated dts.cmake file: /home/vscode/workspaces/base-station-application/aws_iot_mqtt/build/zephyr/dts.cmake

warning: MBEDTLS_MEMORY_DEBUG (defined at
/home/vscode/workspaces/external_dependencies/nrf/subsys/nrf_security/Kconfig.tls:167,
modules/mbedtls/Kconfig:166, modules/mbedtls/Kconfig:166) was assigned the value 'y' but got the
value 'n'. Check these unsatisfied dependencies: ((MBEDTLS_TLS_LIBRARY && NRF_SECURITY) ||
(MBEDTLS_BUILTIN && MBEDTLS) || (MBEDTLS_BUILTIN && MBEDTLS && 0)) (=n). See
http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_MEMORY_DEBUG and/or look up
MBEDTLS_MEMORY_DEBUG in the menuconfig/guiconfig interface. The Application Development Primer,
Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be
helpful too.


warning: MBEDTLS_AES_ROM_TABLES (defined at
/home/vscode/workspaces/external_dependencies/nrf/subsys/nrf_security/Kconfig.legacy:417,
modules/mbedtls/Kconfig.tls-generic:261, modules/mbedtls/Kconfig.tls-generic:261) was assigned the
value 'y' but got the value 'n'. Check these unsatisfied dependencies: ((!(OBERON_BACKEND ||
CC3XX_BACKEND) && MBEDTLS_CIPHER_MODE_CBC && MBEDTLS_AES_C && MBEDTLS_LEGACY_CRYPTO_C &&
NRF_SECURITY) || (MBEDTLS_CIPHER_AES_ENABLED && !(NRF_SECURITY || NORDIC_SECURITY_BACKEND) &&
MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" && MBEDTLS) ||
(MBEDTLS_CIPHER_AES_ENABLED && !(NRF_SECURITY || NORDIC_SECURITY_BACKEND) && MBEDTLS_BUILTIN &&
MBEDTLS_CFG_FILE = "config-tls-generic.h" && MBEDTLS && 0)) (=n). See
http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_AES_ROM_TABLES and/or look up
MBEDTLS_AES_ROM_TABLES in the menuconfig/guiconfig interface. The Application Development Primer,
Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be
helpful too.


warning: MBEDTLS_SSL_ALPN (defined at modules/mbedtls/Kconfig.tls-generic:44,
modules/mbedtls/Kconfig.tls-generic:44) was assigned the value 'y' but got the value 'n'. Check
these unsatisfied dependencies: (((MBEDTLS_TLS_VERSION_1_0 || MBEDTLS_TLS_VERSION_1_1 ||
MBEDTLS_TLS_VERSION_1_2) && MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" && MBEDTLS)
|| ((MBEDTLS_TLS_VERSION_1_0 || MBEDTLS_TLS_VERSION_1_1 || MBEDTLS_TLS_VERSION_1_2) &&
MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" && MBEDTLS && 0)) (=n). See
http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_SSL_ALPN and/or look up
MBEDTLS_SSL_ALPN in the menuconfig/guiconfig interface. The Application Development Primer, Setting
Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be helpful
too.


warning: MBEDTLS_PEM_CERTIFICATE_FORMAT (defined at modules/mbedtls/Kconfig.tls-generic:401,
modules/mbedtls/Kconfig.tls-generic:401) was assigned the value 'y' but got the value 'n'. Check
these unsatisfied dependencies: ((MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" &&
MBEDTLS) || (MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" && MBEDTLS && 0)) (=n).
See http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT and/or
look up MBEDTLS_PEM_CERTIFICATE_FORMAT in the menuconfig/guiconfig interface. The Application
Development Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of
the manual might be helpful too.


warning: MBEDTLS_SERVER_NAME_INDICATION (defined at modules/mbedtls/Kconfig.tls-generic:446,
modules/mbedtls/Kconfig.tls-generic:446) was assigned the value 'y' but got the value 'n'. Check
these unsatisfied dependencies: ((MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" &&
MBEDTLS) || (MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" && MBEDTLS && 0)) (=n).
See http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_SERVER_NAME_INDICATION and/or
look up MBEDTLS_SERVER_NAME_INDICATION in the menuconfig/guiconfig interface. The Application
Development Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of
the manual might be helpful too.


warning: MBEDTLS_HAVE_TIME_DATE (defined at modules/mbedtls/Kconfig.tls-generic:458,
modules/mbedtls/Kconfig.tls-generic:458) was assigned the value 'y' but got the value 'n'. Check
these unsatisfied dependencies: ((MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" &&
MBEDTLS) || (MBEDTLS_BUILTIN && MBEDTLS_CFG_FILE = "config-tls-generic.h" && MBEDTLS && 0)) (=n).
See http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_HAVE_TIME_DATE and/or look up
MBEDTLS_HAVE_TIME_DATE in the menuconfig/guiconfig interface. The Application Development Primer,
Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual might be
helpful too.


warning: MBEDTLS_SSL_MAX_CONTENT_LEN (defined at modules/mbedtls/Kconfig:73,
modules/mbedtls/Kconfig:73) was assigned the value '16384' but got the value ''. Check these
unsatisfied dependencies: ((MBEDTLS_BUILTIN && MBEDTLS) || (MBEDTLS_BUILTIN && MBEDTLS && 0)) (=n).
See http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN and/or look
up MBEDTLS_SSL_MAX_CONTENT_LEN in the menuconfig/guiconfig interface. The Application Development
Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual
might be helpful too.


warning: The choice symbol MBEDTLS_BUILTIN (defined at modules/mbedtls/Kconfig:30,
modules/mbedtls/Kconfig:30) was selected (set =y), but MBEDTLS_LIBRARY_NRF_SECURITY (defined at
/home/vscode/workspaces/external_dependencies/nrf/subsys/nrf_security/Kconfig:293) ended up as the
choice selection. See http://docs.zephyrproject.org/latest/kconfig.html#CONFIG_MBEDTLS_BUILTIN
and/or look up MBEDTLS_BUILTIN in the menuconfig/guiconfig interface. The Application Development
Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual
might be helpful too.

In the warning we can clearly see that MBEDTLS_HAVE_TIME_DATE is not being used.

RE: MBEDTLS time/date support with nRF Security

dejans — Wed, 02 Oct 2024 11:47:10 GMT

Hi,

Can you provide information about your application?

Can you provide complete build log and your project configuration?

Best regards,
Dejan