RE: Issue with provisioning device to communicate via TCP over TLS.

Giannis_Anastasopoulos — Thu, 20 Nov 2025 14:10:45 GMT

After some deeper investigation inside the MBEDTLS stack I found out that the handshake was failing at the point where it was checking the name of the server that I was passing in the

err = setsockopt(fd, SOL_TLS, TLS_HOSTNAME, TCP_SERVER_NAME, sizeof(TCP_SERVER_NAME) - 1);

Since I was testing on a server running locally, the name of the server had the format 192.168.X.X, but the certificate that I was using to verify the server had another name on it. So the authentication was failing at that point.

Thank you very much for the assistance Amanda Hsieh

RE: Issue with provisioning device to communicate via TCP over TLS.

Giannis_Anastasopoulos — Wed, 19 Nov 2025 14:27:08 GMT

Amanda Hsieh

devzone.nordicsemi.com/.../test_5F00_fixed_5F00_certs.zip

In the zip file you can find the certificates I have created with openssl as well as the commands that I have used to debug the TLS communication.

When I am using the openssl client I am able to complete the handshake and communicate with the server:

devzone.nordicsemi.com/.../log_5F00_success.txt

When I try to do the same with the nRF7002DK, the server is rejecting the certificate like this:
devzone.nordicsemi.com/.../log_5F00_failure.txt

My project currently can be stripped down to this:

devzone.nordicsemi.com/.../nRF7002DK_5F00_tcp_5F00_client.zip
I hope this information helps you to guide me through this issue

RE: Issue with provisioning device to communicate via TCP over TLS.

Giannis_Anastasopoulos — Tue, 18 Nov 2025 17:56:59 GMT

Amanda Hsieh

Thank you again for your response.

In my ticket I am describing how I am testing my openssl server. Is this test not adequate?

Any specific suggestions on what and how to test things out?

Does my proj.onf and my code snippets make sense ?

RE: Issue with provisioning device to communicate via TCP over TLS.

Amanda Hsieh — Tue, 18 Nov 2025 17:48:00 GMT

[quote user="Giannis_Anastasopoulos"]Could it be that I am doing something wrong with how I am starting the openssl server and it is not acknowledging properly the CA certificate?[/quote]

That might be possible. You could test and verify the CA certificate with the openssl server.

RE: Issue with provisioning device to communicate via TCP over TLS.

Giannis_Anastasopoulos — Tue, 18 Nov 2025 07:36:31 GMT

Amanda Hsieh

Thank you very much for your response. The certificates I am producing from the above process are already in .pem format (I believe).

These are the certificates I am testing with:

server.crt

server_rsa.key

ca.crt

client.crt

client_rsa.key

I tried appending the Kconfigs you suggested, but without any improvements.

Could it be that I am doing something wrong with how I am starting the openssl server and it is not acknowledging properly the CA certificate?

RE: Issue with provisioning device to communicate via TCP over TLS.

Amanda Hsieh — Mon, 17 Nov 2025 19:44:50 GMT

Hi,

Error 0x2700 is MBEDTLS_ERR_X509_CERT_VERIFY_FAILED, which means that Certificate verification failed, e.g. CRL, CA or signature check failed.

Could you try generating the certificates in .pem file by openssl and use it?

Also, try to add

CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=16384

CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY=y
CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT=y
CONFIG_PSA_WANT_RSA_KEY_SIZE_2048=y

Regards,
Amanda H.