Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

dejans — Fri, 25 Jul 2025 14:42:18 GMT

Hi,

You can check if there is any change when you disable CONFIG_NORDIC_SECURITY_BACKEND in the overlay_native_tls.conf and add two _PSA_WANT_ and RSA configs mentioned previously.

Best regards,
Dejan

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

basvkesteren — Fri, 25 Jul 2025 09:13:01 GMT

Thanks, will look into this and report back.

But, does this mean that the serial_lte_modem native-tls support is broken? (https://github.com/nrfconnect/sdk-nrf/blob/main/applications/serial_lte_modem/overlay-native_tls.conf)

Because that's what my project is based upon.

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

dejans — Thu, 24 Jul 2025 15:09:02 GMT

Hi,

Here are some observations and recommendations.
You are using a lot of legacy configurations as well as CONFIG_NORDIC_SECURITY_BACKEND. It might be that your AES configs and hashes are not properly forwarded to secure image. Please coonsider disabling CONFIG_NORDIC_SECURITY_BACKEND and rely on CONFIG_NRF_SECURITY and PSA crypto configurations moving forward because this is expected to be fully working with TF-M enabled on newer SDK versions. You can find configuration list with PSA dependencies in the PSA TLS sample project configuration. For your ciphersuite support, these configs seem to be missing

CONFIG_PSA_WANT_ALG_GCM=y
CONFIG_PSA_WANT_ALG_SHA_384=y

RSA is not fully supported in PSA crypto. Therefore, several configuration options might be needed. You can refer to RSA configs from this RSA overlay.

Best regards,
Dejan

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

basvkesteren — Thu, 24 Jul 2025 12:23:36 GMT

Hi,

Modem firmware is 1.3.7.

The 3.0.2 project builds on NCS 2.8.0 as-is, there's no code-change needed. Output is in essence the same, full log attached.

Wrt debugging; the problem is not how to debug, but understanding of the PSA code. Thats rather dense stuff.

devzone.nordicsemi.com/.../console_5F00_nativetls_5F00_2.8.txt

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

dejans — Thu, 17 Jul 2025 14:09:33 GMT

Hi,

Which modem firmware version do you use?

Can you provide your project in NCS v2.8.0 and show the log where the same error can be seen?

Have you been able to do some debugging yourself? Here is the information in the documentation - debugging application and
debugging in VS Code.

Best regards,
Dejan

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

basvkesteren — Wed, 16 Jul 2025 08:12:20 GMT

Well, yes, obviously. But that's the problem...

The errorcode originates in an psa_cipher_encrypt() call, which returns PSA_ERROR_NOT_SUPPORTED

Why does it return this errorcode, i have no idea. That PSA code is rather hard to debug, i cannot step through it with the debugger.

It worked on NCS 2.7.0, no longer works on NCS 3.0.2. What changed? Do i need another configuration option? Possible, but which one?

To narrow it down a bit, the same problem happens on NCS 2.8.0, iow the breaking change appears to be in the 2.7.0 to 2.8.0 update.

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

dejans — Tue, 15 Jul 2025 13:36:34 GMT

Hi,

Although my log had some differences from what you showed, I have reprlicated your issue.
Looking at
include/mbedtls/cipher.h: #define MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE -0x6080 (selected feature is unavailable), it seems that some configuration option might be missing which would need to be enabled in your confguration. You could try to debug it yourself looking at the failing lines in the log (ssl_tls.c and ssl12_tls_client.c)

Best regards,
Dejan

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

basvkesteren — Mon, 14 Jul 2025 16:12:46 GMT

That line is from the NRF_MODEM_LIB_ON_CFUN handler in modem.c, the modem has switched to full functionality. Not an error really..

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

dejans — Mon, 14 Jul 2025 15:58:52 GMT

Hi,

It is unexpected that changing functional mode of the modem causes modem error. Do you have any additional information about the error <err> modem: Functional mode has changed to 1?

Best regards,
Dejan

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

basvkesteren — Mon, 14 Jul 2025 06:57:58 GMT

Think I see the problem, the projects i uploaded tried to get version-info from SVN, this fails because they are exports and thus the build fails.

Fixed projects attached:

devzone.nordicsemi.com/.../test_5F00_nativetls_5F00_3.0.2.zip

devzone.nordicsemi.com/.../test_5F00_nativetls_5F00_2.7.zip

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

basvkesteren — Fri, 11 Jul 2025 17:47:16 GMT

Hi,

Both projects are for the nrf9160-dk, I made them specifically so you could easily reproduce it.. How does the build fail for you, what is the error?

I'll recheck them first thing on monday.

RE: Upgrading project from NCS 2.7.0 to 3.0.2 breaks native TLS

dejans — Fri, 11 Jul 2025 17:26:57 GMT

Hi,

Is your error reproducible on nrf9160-dk? I have tried to build your project in NCS v3.0.2. The build was unsuccessful, but I could not replicate the same error.

Best regards,
Dejan