https_client certificate change: "Certificate mismatch" error

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Tue, 05 Nov 2024 13:34:05 GMT

Hi Sunny,

I've found that the best way to obtain X.509 certificate in the proper format is to use Firefox as a browser when accessing the site, and following the same steps to obtain the certificate. Firefox is typically more open source an generates a .pem file as well as a .pem chain in a format that is very user friendly with the 9160DK.

Hope this helps.

RE: https_client certificate change: "Certificate mismatch" error

Sunny_1982 — Tue, 05 Nov 2024 03:56:36 GMT

Hello, I am using nrf9160 dev kit and hosted sample file in github.com and trying to download file using http download example. I am getting http connect error -111. Looks like its certificate error. What are the steps to generate certificates(size should be < 2kb) for this site: raw.githubusercontent.com/.../README.txt

RE: https_client certificate change: "Certificate mismatch" error

Øyvind — Mon, 21 Oct 2024 16:24:50 GMT

The nRF9160 SiP is an Arm Cortex M33 which includes an application core and a modem. The limit is inside of the LTE modem, which means all nRF91-series are currently limited by this 2kB limit.

From the modem FW release notes:

*** Limitations
***************
- TLS/DTLS
    - Secure socket buffer size is 2kB.
    - Maximum length of DTLS datagram is 1kB.
    - One TLS handshake at a time is supported.
    - Concurrent secure connections
        - Maximum server certificate chain size has a limit of 4kB.
        - Two active connections are supported when serialized DTLS connection exists.
        - Two active connections are supported when client certificate size is over 1kB.
        - Two active connections are supported when GNSS acquisition is active.
        - Three active connections are supported when client certificate size is 1kB or less.
        - Four serialized DTLS connections are supported.
    - Server certificate expiry time is not verified.
    - pkcs#8 is not supported.
    - Maximum number of supported credentials is 32. The actual amount depends on size of
      credentials as memory area reserved for credentials may be a limiting factor as well.

The issue can easily be worked around by ensuring that you use correct certificate size which are designed for IoT devices and not PC/browsers.

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Mon, 21 Oct 2024 12:33:33 GMT

Thank you for the information.

[quote userid="77062" url="~/f/nordic-q-a/115197/https_client-certificate-change-certificate-mismatch-error/507055"]The 2kB limitation is inside the modem itself and cannot be changed, unfortunately.[/quote]

Do you know if this is specific to the 9160DK board or if this limit is for any device that is using the nRF9160 chip for development?

RE: https_client certificate change: "Certificate mismatch" error

Øyvind — Mon, 21 Oct 2024 07:35:45 GMT

Hi Stefanos,

Happy to here you resolved the issue.

The 2kB limitation is inside the modem itself and cannot be changed, unfortunately.

Kind regards,
Øyvind

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Thu, 17 Oct 2024 12:22:21 GMT

Hi Øyvind,

I was able to resolve the issue, but I have a different question regarding the .pem file size limit.

[quote userid="77062" url="~/f/nordic-q-a/115197/https_client-certificate-change-certificate-mismatch-error/505305"] The nRF9160 has a limitation of 2kB. [/quote]

Is there a way to increase the limitation to allow for larger X.509 certificates? I know I am able to increase the size of the receive buffer in the source code, but I am not sure if this is the same thing.

Thanks

RE: https_client certificate change: "Certificate mismatch" error

Øyvind — Tue, 15 Oct 2024 13:24:52 GMT

Please verify that you have enabled the UART backend when building the project by using:

west build --board board_target -- -D<image_name>_SNIPPET="nrf91-modem-trace-uart"

As described under:

Adding the nrf91-modem-trace-uart snippet to send modem traces over UART. See nRF91 modem tracing with UART backend using snippets for more details.

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Wed, 09 Oct 2024 12:42:10 GMT

Øyvind,

I attempted to include the setting in the config file like you had mentioned, and received errors when attempting to flash the application to my device (Note: there were no build errors, the image above was only when I attempted to flash the application to the board).

RE: https_client certificate change: "Certificate mismatch" error

Øyvind — Wed, 09 Oct 2024 10:33:17 GMT

The provided modem trace does not show any issues.

You will need to enable modem traces in the https_client sample by including the Modem trace module from the Modem library integration layer i.e. setting CONFIG_NRF_MODEM_LIB_TRACE=y in your pjr.conf

Kind regards,
Øyvind

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Tue, 08 Oct 2024 12:38:24 GMT

Øyvind, when I have https_client flashed to my nRF9160DK, I am unable to do a modem trace. I can only do a modem trace when I have the asset_tracker_v2 demo application flashed to the board. Here is the modem trace file with asset_tracker_v2:

devzone.nordicsemi.com/.../trace_2D00_2024_2D00_10_2D00_08T12_2D00_33_2D00_41.775Z.mtrace

Does the modem trace file need to be with https_client flashed to the board?

Please advise.

RE: https_client certificate change: "Certificate mismatch" error

Øyvind — Tue, 08 Oct 2024 10:11:07 GMT

Thanks for confirming SIM functionality.

[quote user="skar001"]Just to clarify, the .pem file that I am attempting to use is from dweet.io, and I grabbed the x.509 certificate in Google chrome as shown in the image below:[/quote]

Web sites often use a certificate that is much larger, designed for use with computer and phones with a larger memory, etc. The nRF9160 has a limitation of 2kB. Could you please provide the modem trace to verify the certificate size you have downloaded.

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Mon, 07 Oct 2024 18:14:38 GMT

Hi Øyvind,

One more update for you, I needed to change the #include in the main code as well as one line in the MakeFile and now the "...\n" is no longer needed.

That being said, I am still having the exact same issue.

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Mon, 07 Oct 2024 14:35:40 GMT

Hi Øyvind,

Just wanted to update you and let you know I tried a different SIM and was able to do a successful modem trace.

However, even after the successful modem trace, I am still received the exact same issues as before with the https_client application. I believe this now confirms that even with a working SIM card, the issue is not related to the SIM card.

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Mon, 07 Oct 2024 13:28:39 GMT

Hi Øyvind,

I attempted to do a modem trace in the nRF Desktop application like you said. When attempting to run a modem trace with the AT_client sample like you said, I could not even successfully do a modem trace before checking the SIM card:

I also loaded the asset_tracker_v2 and attempted to do a modem trace with this program:

The trace was successful, but the application had a hard time checking the SIM card activation. In the terminal, I see the message "Device is in shell mode":

Will the device operate differently when in shell mode? I am not sure how to continue from here.

[quote userid="77062" url="~/f/nordic-q-a/115197/https_client-certificate-change-certificate-mismatch-error/505113"]Looking at the certificate already available in the https_client sample, this does not have \n[/quote]

You are correct that the original certificate does not have "...\n." The reason why I added it was because I saw someone else do this in a similar issue to mine here when attempting to change their certificate. I also received several build errors with a different certificate if the "...\n" was not added to every line. I re-flashed the original https_client sample to my nRF9160 DK, and this is the exact output of the application:

*** Booting nRF Connect SDK v2.7.0-5cb85570ca43 ***
*** Using Zephyr OS v3.6.99-100befc70c74 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Certificate mismatch
Provisioning certificate
Connecting to the network
+CEREG: 2,"A204","0053C016",7
+CSCON: 1
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
+CEREG: 5,"A204","0053C016",7,,,"11100000","11100000"
Network connectivity established and IP address assigned
Looking up example.com
Resolved 93.184.215.14 (AF_INET)
Connecting to example.com:443
Sent 61 bytes
Received 372 bytes

>        HTTP/1.1 200 OK

Finished, closing socket.
+CGEV: ME PDN DEACT 0
+CEREG: 0
+CGEV: ME DETACH
+CSCON: 0
Network connectivity lost
Disconnected from the network

I am a bit confused, since the output here indicates to me that the https connection to example.com was successful. However, I am still receiving "certificate mismatch" in my output before the connection is established, and the modem trace wasn't successful.

I also removed the "...\n" from my .pem file that I am trying to use so that I can show you the errors that pop up when this is not included in the .pem file (see image below):

Just to clarify, the .pem file that I am attempting to use is from dweet.io, and I grabbed the x.509 certificate in Google chrome as shown in the image below:

When attempting to run my https_client application with a different certificate, this is the exact output I am receiving:

*** Booting nRF Connect SDK v2.7.0-5cb85570ca43 ***
*** Using Zephyr OS v3.6.99-100befc70c74 ***
testing changes
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Certificate mismatch
Provisioning certificate
Connecting to the network
+CEREG: 2,"A283","03CE4715",7
+CSCON: 1
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
+CEREG: 5,"A283","03CE4715",7,,,"11100000","11100000"
Network connectivity established and IP address assigned
Looking up dweet.io
Resolved 52.73.7.7 (AF_INET)
Connecting to dweet.io:443
connect() failed, err: 111
+CGEV: ME PDN DEACT 0
+CEREG: 0
+CGEV: ME DETACH
+CSCON: 0
Network connectivity lost
Disconnected from the network

From what I can tell, this is the same reject cause that I was receiving before.

RE: https_client certificate change: "Certificate mismatch" error

Øyvind — Mon, 07 Oct 2024 08:11:05 GMT

Just to verify full functionality of your device and SIM card, can you please run e.g. AT client, and then from the Cellular Monitor connect to the DK to capture modem traces. You can also collect modem traces from the sample application (https_client) with the failing host name.
These modem traces will provide more information to me to understand the underlying issue on your device.

[quote user=""]Added the .pem file (filename dweet.io.pem) in the /cert directory, as well as added "...\n":[/quote]

Looking at the certificate already available in the https_client sample, this does not have \n
https://github.com/nrfconnect/sdk-nrf/blob/v2.7.0/samples/net/https_client/cert/DigiCertGlobalG2.pem

Please retry adding the CA certificate as done in the sample.

[quote user="oys"]This EMM cause is sent to the UE if the MME cannot service an UE generated request because of PLMN failures.[/quote]

Also, please verify and follow-up the reject cause from the network to ensure proper functionality on your board.

Thank you.

Kind regards,
Øyvind

RE: https_client certificate change: "Certificate mismatch" error

skar001 — Thu, 03 Oct 2024 16:23:04 GMT

Hi Oyvind,

I updated my original message on this ticket in order to more accurately reflect the issue I am dealing with, as well as provide some more information on my setup.

I confirmed that I am using the latest version (2.7.0) and I am using the iBasis nano SIM that came with the device. I believe that there are no issues with this SIM card, since I already successfully connected to example.com (see image below):

I think this issue is directly related to my attempt to change the certificate to a different web browser other than example.com

RE: https_client certificate change: "Certificate mismatch" error

Øyvind — Wed, 02 Oct 2024 17:10:51 GMT

Hello,

[quote user=""] am currently working with the Nordic nRF9160DK and am using the https_client example from the GitHub repository[/quote]

What version of the nRF Connect SDK are you running? Last updated 2021 seems to be very old, i.e. here is a screenshot from NCS tag v2.7.0

I would recommend going through our Developer Academy - Cellular IoT Fundementals if this is your first time with Nordic Semiconductor.

I'm not sure what DevZone posts you are referring to, I would recommend including these to be able to understand what you are trying to achieve.

[quote user=""]cereg: 5,"4115","0336f50f",7,0,17,"11100000","11100000"[/quote]

Your first screenshot tells me that your device is rejected by the network in the Network registration status notification +CEREG. Position 7 - reject cause - includes Cause #17 – Network failure
This EMM cause is sent to the UE if the MME cannot service an UE generated request because of PLMN failures.

What SIM are you using ?

Kind regards,
Øyvind