https_client connection results in error 22 on nRF7002dk

Hi,

I took a HTTPS Client Sample application from nRF SDK v2.6.2 and I cannot make it work.

What I figured out already is that SSL certificate for 'example.com' has changed from Digi Cert Global G2 to DigiCert Global G3. However It still doesn't connect properly.

The only changes that I have done is swapping the SSL certifitacte and adding WIFI credfentials. This is my prj.conf:

#
# Copyright (c) 2023 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# General
CONFIG_HEAP_MEM_POOL_SIZE=1024
CONFIG_MAIN_STACK_SIZE=4096

# Logging
CONFIG_LOG=y

# Network
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y
CONFIG_NET_IPV4=y
CONFIG_NET_IPV6=y
CONFIG_NET_CONNECTION_MANAGER=y
CONFIG_NET_CONNECTION_MANAGER_MONITOR_STACK_SIZE=1024

CONFIG_WIFI_CREDENTIALS_STATIC=y
CONFIG_WIFI_CREDENTIALS_STATIC_SSID="abc"
CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD="xyz"
CONFIG_DNS_RESOLVER=y

The result is as follows:

*** Booting nRF Connect SDK v3.5.99-ncs1-2 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
CA certificate already exists, sec tag: 42
Connecting to the network
[00:00:02.095,062] <inf> wifi_mgmt_ext: Connection requested
Network connectivity established and IP address assigned
Looking up example.com
Resolved 23.215.0.136 (AF_INET)
Connecting to example.com:443
connect() failed, err: 22
Network connectivity lost
Disconnected from the network

I also tried it on the latest nRF SDK 2.9.0 and it doesn't connect either.
Please provide a config that works with this sample on nRF7000dk.

I am looking forward for your support!

Parents

0 Elfving 10 days ago

So the issue lies with example.com in a way. example.com uses ECDSA signature while rest.nordicsemi.academy uses RSA-PSS. A coworker of mine as seen the same issue when trying to connect to mqtt.nordicsemi.academy with the nRF7002 DK which also uses ECDSA signature, I'm looking into whether that is a current limitation or not.

Is the domain you are trying to connect to using ECDSA as well?

If one would want ECDSA supported, it might be that it can be achieved by configuring mbedTLS. One could look at the Kconfigs here. And in the 5340 board files for the sample here.

Regards,

Elfving
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Hardware CI 3 hours ago in reply to Elfving

Hi Elfving

I tried to run l5_e2_sol project with ECDSA crypto enabled. Still no success. Resulting logs below:

*** Booting nRF Connect SDK v3.5.99-ncs1-3 ***
[00:00:01.592,468] <inf> Lesson5_Exercise2: Waiting to connect to Wi-Fi
[00:00:09.509,063] <inf> wifi_mgmt_ext: Connection requested
[00:00:14.650,207] <inf> net_dhcpv4: Received: 172.16.0.204
[00:00:14.650,390] <inf> Lesson5_Exercise2: Network connected
[00:00:14.672,882] <inf> Lesson5_Exercise2: IPv4 address of HTTP server found 23.215.0.136
[00:00:14.807,586] <err> Lesson5_Exercise2: Connecting to server failed, err: 22, Invalid argument
[00:00:14.807,586] <err> Lesson5_Exercise2: Failed to initialize client
[00:00:16.090,850] <err> net_ipv6: Could not add router neighbor fe80::f2b6:61ff:fe4a:dff2 [unknown]
[00:00:16.265,289] <err> net_icmpv6: ICMPv6 handling failure (-5)
[00:00:16.687,530] <err> net_icmpv6: ICMPv6 handling failure (-5)
[00:00:17.702,331] <err> net_icmpv6: ICMPv6 handling failure (-5)
[00:00:28.976,501] <err> net_ipv6: Could not add router neighbor fe80::f2b6:61ff:fe4a:dff2 [unknown]
[00:00:28.981,903] <err> net_icmpv6: ICMPv6 handling failure (-5)
[00:01:38.214,599] <err> net_ipv6: Could not add router neighbor fe80::f2b6:61ff:fe4a:dff2 [unknown]

You can take a look at my project here. I built it with SDK v2.6.2: l5_e2_sol_with_ECDSA.zip

prj.conf:

# Wi-Fi
CONFIG_WIFI=y
CONFIG_WIFI_NRF700X=y
CONFIG_WPA_SUPP=y
CONFIG_WPA_SUPP_CRYPTO_PSA=y

# Wi-Fi Credentials
CONFIG_WIFI_CREDENTIALS=y

# Networking Management API
CONFIG_NET_MGMT=y
CONFIG_NET_MGMT_EVENT=y
CONFIG_NET_MGMT_EVENT_INFO=y
CONFIG_NET_MGMT_EVENT_STACK_SIZE=4096
CONFIG_NET_CONNECTION_MANAGER=y
CONFIG_WIFI_MGMT_EXT=y

# Support for shell commands
CONFIG_SHELL=y
CONFIG_NET_L2_WIFI_SHELL=y
CONFIG_WIFI_CREDENTIALS_SHELL=y
CONFIG_SHELL_STACK_SIZE=5200

# Logging
CONFIG_LOG=y
CONFIG_NET_LOG=y
CONFIG_NET_SOCKETS_LOG_LEVEL_INF=y

# DK library
CONFIG_DK_LIBRARY=y

# System settings
CONFIG_NEWLIB_LIBC=y
CONFIG_NEWLIB_LIBC_NANO=n

# Networking
CONFIG_NETWORKING=y
CONFIG_NET_NATIVE=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y
CONFIG_POSIX_MAX_FDS=16

CONFIG_NET_L2_ETHERNET=y
CONFIG_NET_IPV4=y
CONFIG_NET_IPV6=y
CONFIG_NET_TCP=y
CONFIG_NET_DHCPV4=y
CONFIG_DNS_RESOLVER=y

# TLS
# STEP 1.1 - Enable the TLS library and security relevant configurations
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
CONFIG_TLS_CREDENTIALS=y
CONFIG_MBEDTLS_RSA_C=y
CONFIG_MBEDTLS_DHM_C=y
CONFIG_MBEDTLS_ECDSA_C=y

CONFIG_NRF_SECURITY=y

CONFIG_MBEDTLS_PSA_CRYPTO_C=y
CONFIG_PSA_WANT_ALG_ECDSA=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
CONFIG_PSA_WANT_ECC_SECP_R1_256=y
CONFIG_PSA_WANT_ALG_SHA_256=y
CONFIG_PSA_WANT_ALG_SHA_384=y
CONFIG_PSA_WANT_ALG_ECDSA_ANY=y

CONFIG_PSA_WANT_GENERATE_RANDOM=y

# STEP 1.2 - Enable support for server name indication (SNI)
CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y

# Memory
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096
CONFIG_MAIN_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=153600

CONFIG_NET_TCP_WORKQ_STACK_SIZE=2048
CONFIG_NET_TX_STACK_SIZE=4096
CONFIG_NET_RX_STACK_SIZE=4096
CONFIG_NET_BUF_RX_COUNT=16
CONFIG_NET_BUF_TX_COUNT=16
CONFIG_NET_BUF_DATA_SIZE=256
CONFIG_NET_TC_TX_COUNT=0

# HTTP
CONFIG_HTTP_CLIENT=y

CONFIG_WIFI_CREDENTIALS_STATIC=y
CONFIG_WIFI_CREDENTIALS_STATIC_SSID="Ci Global"
CONFIG_WIFI_CREDENTIALS_STATIC_PASSWORD="1qazxsw2"
CONFIG_WIFI_CREDENTIALS_STATIC_TYPE_PSK=y

My Second attempt was with https example project with enabled ECDSA crypto. Also no success. Logs:

*** Booting nRF Connect SDK v3.5.99-ncs1-3 ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Connecting to the network
[00:00:04.683,135] <inf> wifi_mgmt_ext: Connection requested
[00:00:08.713,745] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x20051628, st=0, user_data=(nil)
[00:00:08.729,522] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:08.765,533] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x20051628, st=0, user_data=(nil)
[00:00:08.778,106] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:08.778,320] <inf> net_dhcpv4: Received: 172.16.0.204
Network connectivity established and IP address assigned
Looking up example.com
[00:00:08.798,614] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x20051628, st=0, user_data=(nil)
[00:00:08.798,797] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): dns status: -100
[00:00:08.798,828] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): dns status: -100
[00:00:08.798,858] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): dns status: -100
[00:00:08.798,889] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): getaddrinfo entries overflow
[00:00:08.798,919] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): dns status: -100
[00:00:08.798,950] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): getaddrinfo entries overflow
[00:00:08.798,980] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): dns status: -100
[00:00:08.798,980] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): getaddrinfo entries overflow
[00:00:08.799,011] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): dns status: -100
[00:00:08.799,041] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): getaddrinfo entries overflow
[00:00:08.799,072] <dbg> net_sock_addr: dns_resolve_cb: (rx_q[0]): dns status: -103
Resolved 96.7.128.198
[00:00:08.800,170] <dbg> net_sock_tls: tls_alloc: (main): Allocated TLS context, 0x2000dce0
[00:00:08.800,750] <dbg> net_sock: zsock_socket_internal: (main): socket: ctx=0x2000ea70, fd=10
Connecting to example.com:443
[00:00:08.806,396] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:08.807,403] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515a0, st=0, user_data=(nil)
[00:00:08.828,063] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:08.985,473] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515a0, st=0, user_data=(nil)
connect() failed, err: 22
[00:00:08.998,199] <dbg> net_sock: z_impl_zsock_close: (main): close: ctx=0x2000dce0, fd=9
[00:00:08.998,382] <dbg> net_sock: z_impl_zsock_close: (main): close: ctx=0x2000ea70, fd=10
[00:00:09.012,878] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.015,777] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515a0, st=0, user_data=(nil)
[00:00:09.216,491] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.217,468] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:09.421,661] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.423,736] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:09.628,906] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.630,126] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:09.631,408] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.632,629] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:09.636,199] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.637,420] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:09.638,641] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.831,451] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x2005166c, st=0, user_data=(nil)
[00:00:09.834,716] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.836,730] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515a0, st=0, user_data=(nil)
[00:00:09.847,259] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515e4, st=0, user_data=(nil)
[00:00:09.848,480] <dbg> net_sock_packet: zpacket_received_cb: (rx_q[0]): ctx=0x2000e900, pkt=0x200515a0, st=0, user_data=(nil)
Network connectivity lost
Disconnected from the network
[00:00:10.041,198] <dbg> net_sock: z_impl_zsock_close: (): close: ctx=0x2000e900, fd=4
[00:00:10.051,330] <dbg> net_sock: z_impl_zsock_close: (net_mgmt): close: ctx=0x20045180, fd=6
[00:00:10.052,001] <dbg> net_sock: z_impl_zsock_close: (net_mgmt): close: ctx=0x20047270, fd=8
[00:00:10.052,642] <dbg> net_sock: z_impl_zsock_close: (net_mgmt): close: ctx=0x200461f8, fd=7
[00:00:10.054,473] <dbg> net_sock: z_impl_zsock_close: (): close: ctx=0x20044108, fd=5

You can take a look at this entire project here (also built with SDK v2.6.2): https_client_2_6_2_with_ECDSA.zip

If it comes to address ci-global-uat-emhuapeeakcrbpb2.z01.azurefd.net/
It's secured using SHA-384 RSA Encryption.

Reply