❓︎ AWS IoT MQTT sample build fails with undefined reference to 'mbedtls_ssl_*' errors (nRF9151, SDK v2.9.0)

[Milan Pipaliya]

Hello Nordic Team,

We are working on a cellular IoT application using the nRF9151 and nRF Connect SDK v2.9.0.
Our goal is to connect to AWS IoT Core using MQTT over TLS.

To begin, we used the AWS IoT MQTT sample from the SDK without making any functional changes.
We only replaced the certificates and updated endpoint information as follows:

• Converted our AWS certificates to C files:

  • Root CA → ca.c

  • Device certificate → cert.c

  • Private key → key.c

• Updated project configuration (proj.conf) with:

  • CONFIG_AWS_ENDPOINT

  • CONFIG_AWS_THING_NAME

  • CONFIG_AWS_PUBLISH_TOPIC

  • CONFIG_AWS_SUBSCRIBE_TOPIC

After building the project, we encountered linker errors related to missing MbedTLS symbols.
Here is the key part of the error log:


/home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_release': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:537: undefined reference to mbedtls_ssl_config_free' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:538: undefined reference to mbedtls_ssl_free' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_mbedtls_init': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1299: undefined reference to mbedtls_ssl_set_bio' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1310: undefined reference to mbedtls_ssl_config_defaults' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1390: undefined reference to mbedtls_ssl_conf_rng' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1428: undefined reference to mbedtls_ssl_setup' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1386: undefined reference to mbedtls_ssl_conf_authmode' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1402: undefined reference to mbedtls_ssl_conf_ciphersuites' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_opt_ciphersuite_list_set': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1553: undefined reference to mbedtls_ssl_conf_ciphersuites' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_session_get': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:652: undefined reference to mbedtls_ssl_session_load' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_session_restore': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:708: undefined reference to mbedtls_ssl_session_init' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:716: undefined reference to mbedtls_ssl_set_session' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:722: undefined reference to mbedtls_ssl_session_free' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_mbedtls_reset': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1166: undefined reference to mbedtls_ssl_session_reset' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_mbedtls_handshake': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1199: undefined reference to mbedtls_ssl_handshake' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_session_save': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:610: undefined reference to mbedtls_ssl_session_save' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:618: undefined reference to mbedtls_ssl_session_save' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_session_store': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:678: undefined reference to mbedtls_ssl_session_init' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:680: undefined reference to mbedtls_ssl_get_session' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:692: undefined reference to mbedtls_ssl_session_free' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function ztls_poll_prepare_pollin': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:2976: undefined reference to mbedtls_ssl_get_bytes_avail' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function ztls_socket_data_check': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:3088: undefined reference to mbedtls_ssl_read' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:3131: undefined reference to mbedtls_ssl_get_bytes_avail' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function ztls_poll_update_pollin': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:3141: undefined reference to mbedtls_ssl_get_bytes_avail' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function recv_tls': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:2589: undefined reference to mbedtls_ssl_read' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_alloc': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:467: undefined reference to mbedtls_ssl_init' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:468: undefined reference to mbedtls_ssl_config_init' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function send_tls': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:2294: undefined reference to mbedtls_ssl_write' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_opt_ciphersuite_list_get': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1571: undefined reference to mbedtls_ssl_list_ciphersuites' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function tls_opt_ciphersuite_used_get': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1599: undefined reference to mbedtls_ssl_get_ciphersuite' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:1604: undefined reference to mbedtls_ssl_get_ciphersuite_id' /home/dnk034/ncs/toolchains/b77d8c1312/opt/zephyr-sdk/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: zephyr/subsys/net/libsubsys__net.a(sockets_tls.c.obj): in function ztls_close_ctx': /home/dnk034/ncs/v2.9.0/zephyr/subsys/net/lib/sockets/sockets_tls.c:2118: undefined reference to mbedtls_ssl_close_notify' collect2: error: ld returned 1 exit status ninja: build stopped: subcommand failed. FAILED: _sysbuild/sysbuild/images/aws_iot_mqtt-prefix/src/aws_iot_mqtt-stamp/aws_iot_mqtt-build /media/dnk034/NEWDATA/manoj/workspace/nrf9151/mod_firm_test_sdk_2.9.0/aws_iot_mqtt/build/_sysbuild/sysbuild/images/aws_iot_mqtt-prefix/src/aws_iot_mqtt-stamp/aws_iot_mqtt-build cd /media/dnk034/NEWDATA/manoj/workspace/nrf9151/mod_firm_test_sdk_2.9.0/aws_iot_mqtt/build/aws_iot_mqtt && /home/dnk034/ncs/toolchains/b77d8c1312/usr/local/bin/cmake --build . ninja: build stopped: subcommand failed. FATAL ERROR: command exited with status 1: /home/dnk034/ncs/toolchains/b77d8c1312/usr/local/bin/cmake --build /media/dnk034/NEWDATA/manoj/workspace/nrf9151/mod_firm_test_sdk_2.9.0/aws_iot_mqtt/build * The terminal process terminated with exit code: 1. * Terminal will be reused by tasks, press any key to close it.


proj.config
CONFIG_AWS_ENDPOINT="a2u7mbay1xxxxxxot.us-west-2.amazonaws.com" CONFIG_AWS_MQTT_PORT=8883 CONFIG_AWS_THING_NAME="xxxx" CONFIG_AWS_PUBLISH_TOPIC="zephyr_sample/data" CONFIG_AWS_SUBSCRIBE_TOPIC="zephyr_sample/downlink" CONFIG_AWS_TEST_SUITE_DQP=n CONFIG_MAIN_STACK_SIZE=4096 CONFIG_ENTROPY_GENERATOR=y CONFIG_TEST_RANDOM_GENERATOR=y CONFIG_INIT_STACKS=y CONFIG_HW_STACK_PROTECTION=y CONFIG_REQUIRES_FULL_LIBC=y CONFIG_SNTP=y CONFIG_JSON_LIBRARY=y CONFIG_POSIX_API=y # DNS CONFIG_DNS_RESOLVER=y CONFIG_DNS_RESOLVER_ADDITIONAL_BUF_CTR=2 CONFIG_DNS_RESOLVER_MAX_SERVERS=1 CONFIG_DNS_SERVER_IP_ADDRESSES=y CONFIG_DNS_SERVER1="8.8.8.8" CONFIG_NET_SOCKETS_DNS_TIMEOUT=5000 CONFIG_DNS_RESOLVER_LOG_LEVEL_DBG=n # Generic networking options CONFIG_NETWORKING=y CONFIG_NET_UDP=y CONFIG_NET_TCP=y CONFIG_NET_IPV6=y CONFIG_NET_IPV4=y CONFIG_NET_SOCKETS=y CONFIG_NET_SOCKETS_SOCKOPT_TLS=y # Logging CONFIG_LOG=y # Network buffers CONFIG_NET_PKT_RX_COUNT=32 CONFIG_NET_PKT_TX_COUNT=16 CONFIG_NET_BUF_RX_COUNT=64 CONFIG_NET_BUF_TX_COUNT=32 # MQTT CONFIG_MQTT_LIB=y CONFIG_MQTT_LIB_TLS=y CONFIG_MQTT_KEEPALIVE=60 CONFIG_MQTT_LIB_TLS_USE_ALPN=y # TLS CONFIG_MBEDTLS=y CONFIG_MBEDTLS_BUILTIN=y CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=65536 CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=16384 CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT=y CONFIG_MBEDTLS_SERVER_NAME_INDICATION=y CONFIG_MBEDTLS_AES_ROM_TABLES=y CONFIG_MBEDTLS_TLS_VERSION_1_2=y CONFIG_MBEDTLS_MEMORY_DEBUG=y CONFIG_MBEDTLS_HAVE_TIME_DATE=y CONFIG_MBEDTLS_SSL_ALPN=y

Despite this, the build fails with undefined references to MbedTLS SSL APIs (as shown above).

---

Environment:

• Hardware: nRF9151 custom board

• nRF Connect SDK: v2.9.0

• Toolchain: Zephyr SDK (arm-zephyr-eabi-gcc 12.2.0)

• Sample: aws_iot_mqtt

---

Question:

Why are these mbedtls_ssl_* references undefined even though MbedTLS is enabled in configuration?
Is there an additional library, configuration, or Kconfig dependency we need to enable for TLS in SDK v2.9.0?

We would appreciate any guidance or pointers to resolve this linker issue and successfully build the AWS IoT MQTT sample.

Thank you,

milan

[dejans]

Hi,

Milan Pipaliya said:

this 30 minute issue not occurs

Does this mean that your issue has been resolved?

Best regards,
Dejan

[Milan Pipaliya]

almost yes,

but last question without disconnecting cellular & aws we reset it gives 30 minute restriction?

[dejans]

Hi Milan,

Modem reset loop restriction happens where there are resets and cellular connection is not closed gracefully. 

The modem counts all resets where the modem is not gracefully deinitialized with +CFUN=0.

There is also this discussion about graceful shutdown of the nrf9160 modem.

Best regards,
Dejan

[Milan Pipaliya]

ok dejan thanks for your valuable responces to give correct path

[dejans]

Hi,

It is great to hear that you found responses valuable. 
Please let me know if you have any other questions. 

Best regards,
Dejan