https client error 113

RE: https client error 113

Håkon Alseth — Tue, 04 Mar 2025 14:47:39 GMT

Hi,

Sorry that I took so much time before responding. I have had some connectivity issues towards this server, and needed to debug that in addition to adding RSA 4096 support.

It seems that there's a problem with the RSA4096 certificate support locally to the project.

This is my added configuration, for enabling mbedtls + debug traces + RSA4096 support:

diff --git a/samples/net/https_client/boards/nrf7002dk_nrf5340_cpuapp_ns.conf b/samples/net/https_client/boards/nrf7002dk_nrf5340_cpuapp_ns.conf
index 9b3cdc5961..00da982e25 100644
--- a/samples/net/https_client/boards/nrf7002dk_nrf5340_cpuapp_ns.conf
+++ b/samples/net/https_client/boards/nrf7002dk_nrf5340_cpuapp_ns.conf
@@ -7,7 +7,7 @@
 # General
 CONFIG_POSIX_CLOCK=y
 CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096
-CONFIG_HEAP_MEM_POOL_SIZE=81920
+CONFIG_HEAP_MEM_POOL_SIZE=120000
 CONFIG_NET_RX_STACK_SIZE=2048
 
 # Optimize Wi-Fi stack to save some memory
@@ -68,3 +68,107 @@ CONFIG_MBEDTLS_TLS_LIBRARY=y
 CONFIG_TFM_PROFILE_TYPE_SMALL=y
 CONFIG_PM_PARTITION_SIZE_TFM_SRAM=0xc000
 CONFIG_PM_PARTITION_SIZE_TFM=0x20000
+
+# Added for ncs v2.6.x
+CONFIG_NET_SOCKETS_TLS_SET_MAX_FRAGMENT_LENGTH=n
+CONFIG_MBEDTLS_MPI_MAX_SIZE=512
+CONFIG_NET_LOG=y
+CONFIG_NET_IPV6=n
+CONFIG_MBEDTLS_DEBUG=y
+CONFIG_MBEDTLS_SSL_DEBUG_ALL=y
+CONFIG_MBEDTLS_LOG_LEVEL_DBG=y
+CONFIG_MBEDTLS_DEBUG_C=y
+CONFIG_MBEDTLS_DEBUG_LEVEL=4
+# Handle the large influx of prints
+CONFIG_LOG_BUFFER_SIZE=16384
+
+# Enable ECDSA
+CONFIG_MBEDTLS_ECDSA_C=y
+CONFIG_PSA_WANT_ALG_ECDSA=y
+CONFIG_MBEDTLS_ECDSA_DETERMINISTIC=y
+CONFIG_PSA_WANT_ALG_DETERMINISTIC_ECDSA=y
+CONFIG_PSA_WANT_ALG_HMAC=y # dependency for DETERMINISTIC_ECDSA
+CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y # dependency for DETERMINISTIC_ECDSA
+
+# Enable ECC
+CONFIG_MBEDTLS_ECP_C=y
+CONFIG_PSA_WANT_ECC_SECP_R1_256=y
+
+
+# NET sockets
+CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
+CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=3
+
+# nRF Security legacy MBed TLS
+CONFIG_NORDIC_SECURITY_BACKEND=y
+CONFIG_MBEDTLS_ENABLE_HEAP=y
+CONFIG_MBEDTLS_HEAP_SIZE=120000
+CONFIG_MBEDTLS_RSA_C=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_MBEDTLS=y
+CONFIG_MBEDTLS_TLS_LIBRARY=y
+CONFIG_MBEDTLS_SSL_SRV_C=y
+CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
+CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=16384
+
+# Enable TLS protocol options
+CONFIG_NET_SOCKETS_TLS_SET_MAX_FRAGMENT_LENGTH=y
+CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
+
+# Enable AES
+CONFIG_MBEDTLS_AES_C=y
+CONFIG_MBEDTLS_CCM_C=y
+CONFIG_MBEDTLS_GCM_C=y
+CONFIG_MBEDTLS_CIPHER_MODE_CBC=y
+CONFIG_MBEDTLS_CIPHER_PADDING_PKCS7=y
+
+# Enable ECC
+CONFIG_MBEDTLS_ECP_C=y
+CONFIG_PSA_WANT_ECC_SECP_R1_256=y
+
+# Enable ECDSA
+CONFIG_MBEDTLS_ECDSA_C=y
+CONFIG_PSA_WANT_ALG_ECDSA=y
+CONFIG_MBEDTLS_ECDSA_DETERMINISTIC=y
+CONFIG_PSA_WANT_ALG_DETERMINISTIC_ECDSA=y
+CONFIG_PSA_WANT_ALG_HMAC=y # dependency for DETERMINISTIC_ECDSA
+CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y # dependency for DETERMINISTIC_ECDSA
+
+# Enable ECDH
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED=y
+CONFIG_MBEDTLS_ECDH_C=y
+CONFIG_PSA_WANT_ALG_ECDH=y
+
+# Enable EDCHE
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=y
+CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
+
+# Enable RSA
+CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
+CONFIG_MBEDTLS_PKCS1_V15=y
+CONFIG_MBEDTLS_MPI_MAX_SIZE=512
+CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y
+CONFIG_PSA_WANT_RSA_KEY_SIZE_2048=y
+CONFIG_PSA_WANT_RSA_KEY_SIZE_4096=y
+
+# Enable SHA
+CONFIG_MBEDTLS_SHA256_C=y
+CONFIG_MBEDTLS_SHA512_C=y
+
+# Disable MBEDTLS modules
+CONFIG_MBEDTLS_CTR_DRBG_C=n
+CONFIG_MBEDTLS_CHACHA20_C=n
+CONFIG_MBEDTLS_POLY1305_C=n
+CONFIG_MBEDTLS_DHM_C=n
+CONFIG_MBEDTLS_CMAC_C=n
+CONFIG_MBEDTLS_CIPHER_MODE_CTR=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED=n
+CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=n
+CONFIG_MBEDTLS_SHA1_C=n
+
+# DNS
+CONFIG_DNS_RESOLVER=y
+CONFIG_NET_SOCKETS_DNS_TIMEOUT=30000
+CONFIG_NET_SOCKETS_CONNECT_TIMEOUT=30000
+
+CONFIG_RESET_ON_FATAL_ERROR=n

.conf file:

devzone.nordicsemi.com/.../0385.nrf7002dk_5F00_nrf5340_5F00_cpuapp_5F00_ns.conf

This now hangs while trying to connect, and returns a -11 (EAGAIN).

However, now and again it succeeds:

*** Booting nRF Connect SDK v3.5.99-ncs1-3 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
CA certificate already exists, sec tag: 42
Connecting to the network
[00:00:02.233,184] <inf> wifi_mgmt_ext: Connection requested
[00:00:16.308,380] <inf> net_dhcpv4: Received: 192.168.1.196
Network connectivity established and IP address assigned
Looking up iot.cht.com.tw
Resolved 20.188.24.130 (AF_INET)
Connecting to iot.cht.com.tw:443
... Took away loads of mbedtls debug output
[00:00:13.707,672] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1997: dumping 'raw buffer after decryption' (2 bytes)
[00:00:13.707,946] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1997: 0000:  01 00                                            ..
[00:00:13.708,007] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:2126: <= decrypt buf
[00:00:13.708,129] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:4017: dumping 'input payload after decrypt' (2 bytes)
[00:00:13.708,404] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:4017: 0000:  01 00                                            ..
[00:00:13.708,526] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5027: got an alert message, type: [1:0]
[00:00:13.708,587] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5041: is a close notify message
[00:00:13.708,740] <err> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:4177: mbedtls_ssl_handle_message_type() returned -30848 (-0x7880)
[00:00:13.708,892] <err> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5736: mbedtls_ssl_read_record() returned -30848 (-0x7880)
Received 231 bytes

>        HTTP/1.1 403 Forbidden

Finished, closing socket.
[00:00:13.709,075] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5974: => write close notify
[00:00:13.709,167] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5103: => send alert message
[00:00:13.709,259] <inf> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5104: send alert level=1 message=0
[00:00:13.709,320] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:2948: => write record
[-5:00:13.709,411] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:0937: => encrypt buf
[00:00:13.709,533] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:0959: dumping 'before encrypt: output payload' (2 bytes)
[00:00:13.709,808] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:0959: 0000:  01 00                                            ..
[00:00:13.709,930] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1186: dumping 'IV used (internal)' (12 bytes)
[00:00:13.710,388] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1186: 0000:  e5 fa 89 08 00 00 00 00 00 00 00 02              ............
[00:00:13.710,723] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1188: dumping 'IV used (transmitted)' (8 bytes)
[00:00:13.711,120] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1188: 0000:  00 00 00 00 00 00 00 02                          ........
[00:00:13.711,242] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1191: dumping 'additional data used for AEAD' (13 bytes)
[00:00:13.711,730] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1191: 0000:  00 00 00 00 00 00 00 02 15 03 03 00 02           .............
[00:00:13.711,853] <inf> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1193: before encrypt: msglen = zu, including 0 bytes of padding
[00:00:13.712,127] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1227: dumping 'after encrypt: tag' (16 bytes)
[00:00:13.712,646] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1227: 0000:  93 9e b9 ae 5f 07 9e db dc 3c ee b7 d2 75 99 5c  ...._....<...u.\
[00:00:13.712,707] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:1478: <= encrypt buf
[00:00:13.712,860] <inf> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:3032: output record: msgtype = 21, version = [3:3], msglen = zu
[00:00:13.712,982] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:3037: dumping 'output record sent to network' (31 bytes)
[00:00:13.713,500] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:3037: 0000:  15 03 03 00 1a 00 00 00 00 00 00 00 02 75 51 93  .............uQ.
[00:00:13.713,989] <dbg> mbedtls: zephyr_mbedtls_debug: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:3037: 0010:  9e b9 ae 5f 07 9e db dc 3c ee b7 d2 75 99 5c     ..._....<...u.\
[00:00:13.714,050] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:2358: => flush output
[00:00:13.714,172] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:2372: message length: zu, out_left: zu
[00:00:13.714,874] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:2379: ssl->f_send() returned 31 (-0xffffffe1)
[00:00:13.714,935] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:2406: <= flush output
[00:00:13.714,996] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:3085: <= write record
[00:00:13.715,057] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5115: <= send alert message
[00:00:13.715,148] <wrn> mbedtls: WEST_TOPDIR/modules/crypto/mbedtls/library/ssl_msg.c:5985: <= write close notify
Network connectivity lost

So I suspect I have a bad connection towards the server.

Could you try this at your end and see if it works now?

Kind regards,

Håkon

RE: https client error 113

shaman — Wed, 26 Feb 2025 07:57:35 GMT

I found HiPKI Root CA - G1 at https://eca.hinet.net/repository-h/download/HRCA_b64.crt

and i change CMakeLists.txt

    cert/DigiCertGlobalG2.pem
    ${gen_dir}/DigiCertGlobalG2.pem.inc

    cert/HRCA_b64.crt
    ${gen_dir}/DigiCertGlobalG2.pem.inc

connection failed.

Same code on 9151 ok.

RE: https client error 113

shaman — Wed, 26 Feb 2025 07:34:47 GMT

How to add to my project? I searched Kconfig GUI and not found.

RE: https client error 113

Håkon Alseth — Fri, 21 Feb 2025 08:28:00 GMT

You need to add "HiPKI Root CA - G1" to your project and use that for verifying this specific domain.

Here's a screenshot from my browser when inspecting the domain:

Kind regards,

Håkon

RE: https client error 113

shaman — Fri, 21 Feb 2025 02:04:23 GMT

How? That is server certificate, I could not ask them to change?

RE: https client error 113

Håkon Alseth — Thu, 20 Feb 2025 10:59:41 GMT

Hi,

[quote user="shaman"]* issuer: C=TW; O=Chunghwa Telecom Co., Ltd.; CN=HiPKI OV TLS CA - G1[/quote]

Could you try with "HiPKI Root CA - G1" instead?

Kind regards,

Håkon

RE: https client error 113

shaman — Thu, 20 Feb 2025 10:52:53 GMT

using the same pem file

% curl -v -I --cacert cert/DigiCertGlobalRootG2.pem https://iot.cht.com.tw
* Host iot.cht.com.tw:443 was resolved.
* IPv6: (none)
* IPv4: 20.188.24.130
* Trying 20.188.24.130:443...
* Connected to iot.cht.com.tw (20.188.24.130) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: cert/DigiCertGlobalRootG2.pem
* CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
* subject: C=TW; L=\U81FA\U5317\U5E02; O=\U4E2D\U83EF\U96FB\U4FE1\U80A1\U4EFD\U6709\U9650\U516C\U53F8; CN=*.iot.cht.com.tw
* start date: Dec 16 09:45:19 2024 GMT
* expire date: Dec 16 09:45:19 2025 GMT
* subjectAltName: host "iot.cht.com.tw" matched cert's "iot.cht.com.tw"
* issuer: C=TW; O=Chunghwa Telecom Co., Ltd.; CN=HiPKI OV TLS CA - G1
* SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://iot.cht.com.tw/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: iot.cht.com.tw]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> HEAD / HTTP/2
> Host: iot.cht.com.tw
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 403
HTTP/2 403
< server: nginx
server: nginx
< date: Thu, 20 Feb 2025 10:51:46 GMT
date: Thu, 20 Feb 2025 10:51:46 GMT
< content-type: text/html; charset=utf-8
content-type: text/html; charset=utf-8
< content-length: 146
content-length: 146
< strict-transport-security: max-age=31536000; includeSubDomains; preload
strict-transport-security: max-age=31536000; includeSubDomains; preload
<

* Connection #0 to host iot.cht.com.tw left intact