7762.wireshark_trace_clienthello_only_scsv.pcapng
Summary
We are trying to perform a DTLS 1.2 handshake using PSK (Pre-Shared Key)
from an **nRF9151 module running NCS v3.0.2, using modem-offloaded DTLS (IPPROTO_DTLS_1_2).
- LTE connects successfully
- PSK Identity + Key are provisioned to security tag 42
- The socket is configured with `TLS_SEC_TAG_LIST` and `TLS_PEER_VERIFY_NONE`
- DTLS handshake always fails with `errno = 111` (`ECONNREFUSED`)
- Wireshark trace shows the modem sends a DTLS ClientHello containing only: that means no usable cipher suites get advertised.
Expected Behavior
The client should send a DTLS ClientHello advertising PSK cipher suites such as:
- - `TLS_PSK_WITH_AES_128_CCM_8`
- - `TLS_PSK_WITH_AES_128_CCM`
And the server should reply with ServerHello → PSK Key Exchange.
This works correctly using:
OpenSSL-based client Go client (Pion/dtls) 
Fails only with the nRF91 modem-based DTLS client
Actual Behavior
- Although PSK identity and key are provisioned correctly inside the modem, the ClientHello sent by the nRF9151 does not include any PSK cipher suite (e.g., TLS_PSK_WITH_AES_128_CCM_8). Instead, it offers only ECDHE-based certificate cipher suites followed by TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00FF). As a result, the DTLS handshake fails with no shared cipher suite.
- Server (Go or OpenSSL) rejects handshake
- Client receives errno=111.
Files Included
| File | Description |
|------|-------------|
| `main.c` | Full C source used on nRF9151 |
| `prj.conf` | Project configuration |
| `wireshark_trace_clienthello_only_scsv.pcapng` | Modem trace export |
| `server_log.txt` | Output from Go/openssl servers (no shared cipher) |
Test with OpenSSL
> openssl s_server -dtls -accept 5684 -nocert -psk 73757065727365637265746b6579313233 -psk_identity device001 -cipher "PSK-AES128-CCM8:PSK-AES128-CCM:PSK-AES128-CBC-HA"
Returns:
Using default temp DH parameters
ACCEPT
ERROR
4057EA2E827B0000:error:0A0000C1:SSL routines:tls_post_process_client_hello:no shared cipher:../ssl/statem/statem_srvr.c:2220:
shutting down SSL
CONNECTION CLOSED
PSK Used
Identity: device001
Key: supersecretkey123
Confirmed stored under SEC_TAG=42.
Questions to Nordic
Why does modem DTLS not include PSK ciphers in ClientHello?
Is IPPROTO_DTLS_1_2 + TLS_SEC_TAG_LIST enough to enable PSK?
Do we need to explicitly set TLS_DTLS_VERSION, TLS_CIPHERSUITE_LIST, or something undocumented?
Is this a known issue in nRF9151 modem firmware v1.x?
Can you help me to get the DTLS handshake complete with success?
In the final product, the DTLS stuff must coexist with the LwM2M (which I already successfully tested 0m nRF9161 platform using Eclipse Leshan together with lwm2m client sample) one on nRF9151.
Thank you in advance for your support!
