Failed to define MBEDTLS_X509_CRT_WRITE_C even after adding appropriate configs in prj.conf file

[AR Jadhav]

Hello,

I am having nRF9160 with modem FW = 1.3.6 and nrf sdk version 2.7.0

I am using MBEDTLS library for generating self-signed & CSR certificates with EC-Key and RSA key. I am adding following configs in my prj.conf file

    MBEDTLS_X509_CSR_WRITE_C

    MBEDTLS_X509_CREATE_C

    MBEDTLS_ENTROPY_C

    MBEDTLS_CTR_DRBG_C

    MBEDTLS_PK_WRITE_C

    MBEDTLS_ZEPHYR_ENTROPY

    MBEDTLS

    MBEDTLS_ENABLE_HEAP

    MBEDTLS_TLS_LIBRARY

    MBEDTLS_X509_LIBRARY

    NRF_SECURITY_ADVANCED

    NORDIC_SECURITY_BACKEND

    MBEDTLS_DHM_C

    MBEDTLS_ECDH_C

    MBEDTLS_ECDSA_C

    MBEDTLS_ECP_C

    MBEDTLS_ECJPAKE_C

    MBEDTLS_GCM_C

    MBEDTLS_CIPHER_C

    MBEDTLS_RSA_C

    PSA_WANT_RSA_KEY_SIZE_2048

Even after enabling this configs MBEDTLS_X509_CRT_WRITE_C is not getting enabled in autoconf.h file. Because of this I am not able to compile the code and go ahead.

Can you please suggest probable reason or steps to get this resolved.

[AR Jadhav]

Hello Dejan,

I went over to try the change you suggest but surprisingly found that in I am not seeing MBEDTLS_X509_CRT_WRITE_C config in kconfig.tls file. 

The nrf version we are using is v2.7.0.

Can you please suggest the link you shared refers to which nrf version

sdk-nrf/subsys/nrf_security/Kconfig.tls at 27bd6be1ccdbf4b434f450ef8eaf6e2e3a0bfe4d · nrfconnect/sdk-nrf

- Below is the nrf-prefixed config from build directory:

./modules/nrf/subsys/nrf_security/src/include/generated/nrf-psa-crypto-want-config.h
./modules/nrf/subsys/nrf_security/src/include/generated/nrf-config.h
./modules/nrf/subsys/nrf_security/src/include/generated/nrf-psa-crypto-config.h
./tfm/secure_fw/partitions/crypto/mbedcrypto/nrf_security_src/include/generated/nrf-psa-crypto-want-config.h
./tfm/secure_fw/partitions/crypto/mbedcrypto/nrf_security_src/include/generated/nrf-config.h
./tfm/secure_fw/partitions/crypto/mbedcrypto/nrf_security_src/include/generated/nrf-psa-crypto-config.h
./tfm/api_ns/platform/common/core/common/nrf-pinctrl.h

Thanks,

Akshay

[dejans]

Hi Akshay,

Here is a correct link to Kconfig file in NCS v2.7.0
github.com/.../Kconfig.tls

AR Jadhav said:

I went over to try the change you suggest but surprisingly found that in I am not seeing MBEDTLS_X509_CRT_WRITE_C config in kconfig.tls file. 

You are correct. Thank you for pointing this out. I double-checked in NCS v2.7.0 and could not find specific Kconfig as well. There will be PR for fixing this. Until then, you could try to add it manually for testing.

Best regards,
Dejan

[AR Jadhav]

Thanks for the update Dejan.

So how this fix will be? A patch on same version v2.7.0 or you will be suggesting a closer version to current version which has this fix?

[dejans]

Hi,

I will provide more information about the fix PR when it becomes available. I expect to get back to you during next week.

Best regards,
Dejan

[dejans]

Hi,

Please find PR below.
github.com/.../

Best regards,
Dejan