LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

yess bz — Fri, 20 Mar 2026 09:59:11 GMT

it works the solution of tls connexion By provisioning the entire chain( E8 + ISRG Root X1 ) but now i have another problem :

The TLS connection works perfectly.
The certificate is valid.
The server refuses access to the file zephyr.signed.bin because authentication is required.

The server leshan.egconnect.cloud requires authentication to download the firmware file. the server has an authentification to access on

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

Syed Maysum Abbas Zaidi — Thu, 19 Mar 2026 12:41:00 GMT

Hi,

Great to hear that, and thanks for sharing so provisioning the full certificate chain in a single modem_key_mgmt_write() call with MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN was the correct fix for your certificate issue.

Can you confirm whether the FOTA download is now working end to end on the device? If yes, we can close this out.

Best Regards,
Syed Maysum

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

yess bz — Thu, 19 Mar 2026 09:39:40 GMT

Hello,

I wasn’t sure how to configure it, so I got stuck

curl -v https://leshan.egconnect.cloud/zephyr.signed.bin
COMMENTAIRES : GET with 0-byte payload
curl : 401 Authorization Required
nginx
Au caractère Ligne:1 : 1
+ curl -v https://leshan.egconnect.cloud/zephyr.signed.bin
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation : (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

and i think i have a problem with the certificate

the error -111 (ECONNREFUSED) you were seeing was caused by a certificate validation failure during the TLS handshake. The nRF9160 modem had the ISRG Root X1 root certificate, but it couldn’t validate your server’s certificate because the E8 intermediate certificate was missing from the chain.

By provisioning the full chain (E8 + ISRG Root X1) in a single call to modem_key_mgmt_write() using the type MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN, the modem can now properly validate your server’s certificate.

Best Regards,

Ben zeineb yassmine

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

Syed Maysum Abbas Zaidi — Thu, 19 Mar 2026 09:07:43 GMT

Hi,

You are right that the local IP issue is what caused the HTTP failure, the device on LTE cannot reach 192.168.x.x at all, so that makes sense.

However, before moving forward, we want to make sure the HTTPS failure is not a separate issue. Even after you provisioned the certificate, the HTTPS download still failed with the same -111 error. This suggests the problem may not just be network accessibility, it is possible that leshan.egconnect.cloud/zephyr.signed.bin is not actually serving the firmware file at all, since Leshan is primarily an LwM2M management server and unless specifically configured to also serve static files, leshan.egconnect.cloud/zephyr.signed.bin may not be returning the file.

Can you quickly verify this by running:

curl -v https://leshan.egconnect.cloud/zephyr.signed.bin

Or simply try opening that URL in a browser. If it returns a 404 or connection error, the file is not being served there and that could be the actual blocker so moving to a public server IP alone will not fix it. Then the firmware binary needs to be hosted on a separate publicly accessible file server such as AWS S3. Let us know what the curl output shows. Thanks.

Best Regards,
Syed Maysum

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

yess bz — Wed, 18 Mar 2026 15:54:20 GMT

HTTP configuration (local server)

,519] <inf> app_lwm2m_client: FOTA download started for instance 0
[00:36:05.209,411] <inf> fota_download_util: Download url http://192.168.1.46:8000/zephyr.signed.bin
[00:36:05.209,503] <inf> fota_download_util: Download Path zephyr.signed.bin host http://192.168.1.46:8000
[00:36:05.213,226] <inf> downloader: Host lookup failed for hostname 192.168.1.46 on IPv6 (err -22), attempting IPv4
[00:36:05.216,705] <inf> downloader: Connecting to 192.168.1.46
[00:36:29.223,419] <err> downloader: Failed to connect, err -116
[00:36:29.223,449] <err> fota_download: Downloader error event -116
[00:36:29.223,480] <err> lwm2m_firmware: FOTA_DOWNLOAD_EVT_ERROR
[00:36:29.223,480] <inf> lwm2m_firmware: FOTA download failed, target 0
[00:36:29.231,842] <inf> app_lwm2m_client: FOTA failure 0 by status 4

I hosted the firmware using a local Python server:

python -m http.server 8000

The firmware URL used was:

192.168.1.46:8000/zephyr.signed.bin

but doesn't work

HTTPS configuration (with CA certificate)
I extracted the CA certificate from the server and integrated it into the modem using:

modem_key_mgmt_write()

I also configured:

CONFIG_LWM2M_CLIENT_UTILS_DOWNLOADER_SEC_TAG=1

Despite this, the HTTPS download still fails.

 :03.343,597] <inf> app_lwm2m_client: FOTA download started for instance 0
[00:04:03.344,299] <inf> fota_download_util: Download url https://leshan.egconnect.cloud/zephyr.signed.bin
[00:04:03.344,360] <inf> fota_download_util: Download Path zephyr.signed.bin host https://leshan.egconnect.cloud
[00:04:03.348,815] <inf> downloader: Host lookup failed for hostname leshan.egconnect.cloud on IPv6 (err -22), attempting IPv4
[00:04:03.433,502] <inf> net_lwm2m_rd_client: Update callback (code:2.4)
[00:04:03.433,563] <dbg> app_lwm2m_client: rd_client_event: Registration update complete
[00:04:03.433,593] <inf> net_lwm2m_rd_client: Update Done
[00:04:03.532,379] <inf> net_lwm2m_message_handling: Send done!
[00:04:03.533,386] <inf> net_lwm2m_message_handling: Send done!
[00:04:03.542,877] <inf> lwm2m_rai: Ongoing traffic, RAI disabled
[00:04:04.537,719] <inf> downloader: Setting up TLS credentials, sec tag count 1
[00:04:04.537,841] <inf> downloader: Connecting to 91.134.59.209
[00:04:05.689,239] <err> downloader: Failed to connect, err -111
[00:04:05.689,270] <err> fota_download: Downloader error event -111
[00:04:05.689,300] <err> lwm2m_firmware: FOTA_DOWNLOAD_EVT_ERROR
[00:04:05.689,300] <inf> lwm2m_firmware: FOTA download failed, target 0
[00:04:05.691,406] <inf> app_lwm2m_client: FOTA failure 0 by status 4

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

yess bz — Wed, 18 Mar 2026 15:39:40 GMT

Here is a summary of what i did :

HTTP configuration (local server)
I hosted the firmware using a local Python server:

python -m http.server 8000

The firmware URL used was:

192.168.1.46:8000/zephyr.signed.bin

However, the download fails with a connection error. After investigation, I believe this is because the device is connected over LTE, and therefore cannot access my local IP address (192.168.1.46).

,519] <inf> app_lwm2m_client: FOTA download started for instance 0
[00:36:05.209,411] <inf> fota_download_util: Download url http://192.168.1.46:8000/zephyr.signed.bin
[00:36:05.209,503] <inf> fota_download_util: Download Path zephyr.signed.bin host http://192.168.1.46:8000
[00:36:05.213,226] <inf> downloader: Host lookup failed for hostname 192.168.1.46 on IPv6 (err -22), attempting IPv4
[00:36:05.216,705] <inf> downloader: Connecting to 192.168.1.46
[00:36:29.223,419] <err> downloader: Failed to connect, err -116
[00:36:29.223,449] <err> fota_download: Downloader error event -116
[00:36:29.223,480] <err> lwm2m_firmware: FOTA_DOWNLOAD_EVT_ERROR
[00:36:29.223,480] <inf> lwm2m_firmware: FOTA download failed, target 0
[00:36:29.231,842] <inf> app_lwm2m_client: FOTA failure 0 by status 4

HTTPS configuration (with CA certificate)
I extracted the CA certificate from the server and integrated it into the modem using:

modem_key_mgmt_write()

I also configured:

CONFIG_LWM2M_CLIENT_UTILS_DOWNLOADER_SEC_TAG=1

Despite this, the HTTPS download still fails.

:03.343,597] <inf> app_lwm2m_client: FOTA download started for instance 0
[00:04:03.344,299] <inf> fota_download_util: Download url https://leshan.egconnect.cloud/zephyr.signed.bin
[00:04:03.344,360] <inf> fota_download_util: Download Path zephyr.signed.bin host https://leshan.egconnect.cloud
[00:04:03.348,815] <inf> downloader: Host lookup failed for hostname leshan.egconnect.cloud on IPv6 (err -22), attempting IPv4
[00:04:03.433,502] <inf> net_lwm2m_rd_client: Update callback (code:2.4)
[00:04:03.433,563] <dbg> app_lwm2m_client: rd_client_event: Registration update complete
[00:04:03.433,593] <inf> net_lwm2m_rd_client: Update Done
[00:04:03.532,379] <inf> net_lwm2m_message_handling: Send done!
[00:04:03.533,386] <inf> net_lwm2m_message_handling: Send done!
[00:04:03.542,877] <inf> lwm2m_rai: Ongoing traffic, RAI disabled
[00:04:04.537,719] <inf> downloader: Setting up TLS credentials, sec tag count 1
[00:04:04.537,841] <inf> downloader: Connecting to 91.134.59.209
[00:04:05.689,239] <err> downloader: Failed to connect, err -111
[00:04:05.689,270] <err> fota_download: Downloader error event -111
[00:04:05.689,300] <err> lwm2m_firmware: FOTA_DOWNLOAD_EVT_ERROR
[00:04:05.689,300] <inf> lwm2m_firmware: FOTA download failed, target 0
[00:04:05.691,406] <inf> app_lwm2m_client: FOTA failure 0 by status 4

Root cause (suspected)
It seems that the main issue is network accessibility:

The firmware is hosted on my local machine (192.168.x.x)
The device is connected via LTE
Therefore, it cannot reach the firmware server

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

Syed Maysum Abbas Zaidi — Wed, 18 Mar 2026 12:32:07 GMT

Hi,

Just to clarify, app_update.bin is not missing. In newer NCS versions with sysbuild, it has been renamed to zephyr.signed.bin, found at build/<your_app_name>/zephyr/zephyr.signed.bin. That's the correct file to use in your firmware URL.

However, the file name is not what's blocking the update. As mentioned in my previous reply, the download is failing due to the TLS certificate error (-111). The device can't connect to your HTTPS server because the server's CA certificate isn't provisioned in the modem.

Could you try the steps I shared earlier, extracting the server certificate and provisioning it with CONFIG_LWM2M_CLIENT_UTILS_DOWNLOADER_SEC_TAG? or alternatively if you want a quicker way to test first then try switching to plain HTTP and host the firmware on server.

Best Regards,
Syed Maysum

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

luqman — Tue, 17 Mar 2026 21:08:30 GMT

Hi,

Looking at your logs, the issue is clear:

downloader: Setting up TLS credentials, sec tag count 1
downloader: Failed to connect, err -111

You're using https:// in your firmware URI, but the modem can't establish TLS because no valid CA certificate is provisioned for that Leshan server. That's why it connects on TCP level (you can see it resolves the IP fine) but fails at the TLS handshake.

You have two options:

Option A (recommended, easiest, and most reliable over cellular)

Switch to plain HTTP. Host the firmware on your server:

bash
cd ~/ota
python3 -m http.server 8000

Then in Leshan UI write to /5/0/1 (Package URI):

http://<your-server-ip>:8000/zephyr.signed.bin

Make sure port 8000 is open in your firewall/security group inbound rules.

Option B — Keep HTTPS, provision the CA certificate

bash
openssl s_client -connect leshan.yourserver.com:443 </dev/null 2>/dev/null | openssl x509 -outform PEM > leshan_ca.pem

Provision it into the modem at a security tag:

modem_key_mgmt_write(1, MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN, cert, cert_len);

And add to prj.conf:

CONFIG_FOTA_DOWNLOAD_SEC_TAG=1

Also regarding app_update.bin, atleast for me in newer NCS with sysbuild it's no longer generated. The equivalent file is build/app/zephyr/zephyr.signed.bin. It's the same MCUboot-signed OTA image, just renamed. Use it directly in your firmware URL.

hope that ressolve your issue

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

yess bz — Tue, 17 Mar 2026 15:51:49 GMT

The problem is that my device cannot find the app_update.bin file, and I don’t know how to properly configure the connection to access it

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

Syed Maysum Abbas Zaidi — Tue, 17 Mar 2026 15:39:13 GMT

Hi,

Your error indicates the downloader is attempting a TLS connection but failing. As the error -111 is ECONNREFUSED which means Connection refused that it indicates an error with the configured certificates.

So either no valid certificate is provisioned for the Leshan HTTPS server on the security tag or the certificate stored in the modem does not match the one the server presents

So can you try this out:

1. Get the CA certificate (or self signed cert) that the Leshan server uses for HTTPS. If Leshan is using a self signed certificate, you can extract it with:

openssl s_client -showcerts -connect leshan.example.com:443

2. Provision that CA certificate into a security tag in the modem. You can do this with the Cellular Monitor app or using modem_key_mgmt_write() with credential type MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN as shown here.

3. Then add the Kconfig option that points the FOTA downloader to that security tag:

CONFIG_LWM2M_CLIENT_UTILS_DOWNLOADER_SEC_TAG=<your_chosen_sec_tag>

Best Regards,
Syed Maysum

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

yess bz — Tue, 17 Mar 2026 13:38:00 GMT

i'am currently working on a FOTA implementation I am using nRF9160 DK with nRF Connect SDK v3.1.1 and the LwM2M client sample (/samples/cellular/lwm2m_client/). I am using LwM2M with the Leshan server over the CoAP protocol.

I am facing an issue: the app_update.bin file is no longer generated. I replaced it with zephyr.signed.bin in the update URL, but no FOTA update is triggered.

this is my configuration

#MCUboot
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_BUILD_OUTPUT_BIN=y
CONFIG_IMG_MANAGER=y
CONFIG_MCUBOOT_IMG_MANAGER=y

#Flash support
CONFIG_FLASH=y
CONFIG_FLASH_MAP=y
CONFIG_STREAM_FLASH=y

#LwM2M firmware object
CONFIG_LWM2M_FIRMWARE_UPDATE_OBJ_SUPPORT=y

CONFIG_POSIX_API=y

# Allow FOTA downloads using download-client
CONFIG_DOWNLOADER=y
CONFIG_DOWNLOADER_STACK_SIZE=4096
CONFIG_FOTA_DOWNLOAD=y

Here are the logs I am getting

00:07:16.822,967] fota_download_util: Download url https://xxxxxx/zephyr.signed.bin
[00:07:16.823,028] fota_download_util: Download Path zephyr.signed.bin host https://leshan.xxxxxx
[00:07:16.826,782] downloader: Host lookup failed for hostname leshan.xxxxxx on IPv6 (err -22), attempting IPv4
[00:07:16.980,712] downloader: Setting up TLS credentials, sec tag count 1
[00:07:16.980,834] downloader: Connecting to 91.134.59.209
[00:07:18.089,569] downloader: Failed to connect, err -111
[00:07:18.089,599] fota_download: Downloader error event -111
[00:07:18.089,630] lwm2m_firmware: FOTA_DOWNLOAD_EVT_ERROR
[00:07:18.089,630] lwm2m_firmware: FOTA download failed, target 0
[00:07:18.092,742] app_lwm2m_client: FOTA failure 0 by status 4

you can send me your configuration you added to upload FOTA

because i try and so manyt times and nothing works

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

Syed Maysum Abbas Zaidi — Tue, 27 Jan 2026 15:21:04 GMT

Hi,

Thanks for testing and sharing the details.

For FOTA testing with the lwm2m_client sample and the Leshan demo server, we recommend focusing on pull mode (writing the firmware URI to /5/0/1). Although /5/0/9 reports that both modes are supported, push mode (writing the firmware directly to /5/0/0) is more sensitive to network conditions when transferring large images over cellular/UDP. The Leshan project also notes this limitation for large payload transfers over CoAP block-wise, and therefore recommends using a URI-based download when possible:

https://github.com/eclipse-leshan/leshan/wiki/Using-CoAP-Block-Wise-to-transfer-large-file-%3F

And to get more insight into where the download may be stalling, you can also enable more verbose logging if not already enabled:

CONFIG_LOG=y
CONFIG_LWM2M_LOG_LEVEL_DBG=y
CONFIG_COAP_LOG_LEVEL_DBG=y

Best Regards,
Syed Maysum

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

luqman — Mon, 26 Jan 2026 23:10:46 GMT

Hi Syed,

I've applied all your recommended configurations to the samples/cellular/lwm2m_client sample but FOTA still fails.

Applied configs:

CONFIG_LWM2M_COAP_BLOCK_SIZE=512
CONFIG_LWM2M_UPDATE_PERIOD=60
CONFIG_LWM2M_QUEUE_MODE_UPTIME=600000
CONFIG_LWM2M_RD_CLIENT_LISTEN_AT_IDLE=y
PSM/eDRX enabled (not using aggressive overlay)

Issues:

Push mode fails most of the time - Resource /5/0/9 shows 2 (both modes supported) but writing firmware to /5/0/0 (Package resource) usually returns error 501 or times out.
Some time Downloads stall at 5-8% - On rare occasions when FOTA starts, it downloads 5-8% then stops completely. Device remains connected and sends registration updates every 60 seconds. No error messages in logs.

Setup:

SDK v3.2.1, nRF9151DK
Onomondo SIM (blocks TCP/HTTPS, allows CoAP/UDP)
Public Leshan server (coaps://leshan.eclipseprojects.io:5684)
Firmware: zephyr.signed.bin (841 Kb)

Questions:

What's the recommended way to test FOTA with the lwm2m_client sample and public Leshan demo server?
Any additional configs or logging to debug why downloads stall?

RE: LwM2M FOTA Download Stalls at 1–2% on nRF9160 over NB-IoT/LTE-M

Syed Maysum Abbas Zaidi — Mon, 26 Jan 2026 14:40:31 GMT

Hi.

From the config you shared, I would first of all recommend you to try CONFIG_LWM2M_COAP_BLOCK_SIZE=512 and retest as there is a limitation mentioned here.

1. It is recommended to use pull delivery mode with CoAP or HTTP and starting from the lwm2m_client sample, enabling the overlay-fota_helper.conf overlay, which improves responsiveness in queue mode by using a 60-second update period.

For large firmware downloads over LTE-M/NB-IoT, you may tune LwM2M queue-mode and timing parameters so the device stays online and listening long enough to complete the transfer. This includes increasing CONFIG_LWM2M_QUEUE_MODE_UPTIME, using a shorter CONFIG_LWM2M_UPDATE_PERIOD (similar to what overlay-fota_helper.conf does), and selecting an idle mode such as CONFIG_LWM2M_RD_CLIENT_LISTEN_AT_IDLE so the client keeps its socket open while the download is in progress.

2. You do not have to disable PSM/eDRX for FOTA, as Nordic’s own lwm2m_client FOTA setup runs with PSM and eDRX enabled. However, aggressive PSM/eDRX or short queue-mode uptime can cause long block-wise transfers to stall. For large FOTA transfers, it is recommended to avoid very aggressive power-saving settings (like overlay-aggressive-psm.conf overlay file).

And there are no specific limitations to Onomondo SIMs or AWS-hosted Leshan servers for LwM2M FOTA. You may try out the above mentioned configurations and check if it works.

Best Regards,
Syed Maysum