https_client sample: connection refused

RE: https_client sample: connection refused

ao38 — Fri, 24 Apr 2026 12:51:10 GMT

Hi Syed,

I did a pristine build and it didn't change the result.

Adding the two lines you gave in the prj.conf, the log is now:

HTTPS client sample started
Bringing network interface up
Provisioning certificate
Certificate match
Connecting to the network
+CEREG: 2,"79CD","07E42508",7
+CSCON: 1
+CGEV: ME PDN ACT 0
%MDMEV: SEARCH STATUS 2
+CEREG: 5,"79CD","07E42508",7,,,"11100000","11100000"
+CSCON: 0

Thank you for your help.

Best regards,

Arthur

RE: https_client sample: connection refused

Syed Maysum Abbas Zaidi — Fri, 24 Apr 2026 09:08:55 GMT

Hi,

Thanks for your response. First of all can you please confirm if you did pristine build after making the changes in prj.conf to make sure the issue is not related to stale build. Secondly your log shows +CNEC_ESM: 50,0 means your network is providing IPv4 only, no IPv6. But the sample is configured for dual-stack (IPv4 + IPv6 by default), so it waits for an IPv6 address that never arrive and may be resulting in a non-deterministic behavior.

So if it still hangs after pristine build, you may tell the modem to request IPv4 only, by adding the overlay, using any of the two ways below:

1. Pass it at build time:

west build -b nrf9160dk/nrf9160/ns -- -DEXTRA_CONF_FILE=overlay-pdn-nrf91-ipv4.conf

2. Add the two lines directly to prj.conf:

CONFIG_LTE_LC_PDN_DEFAULTS_OVERRIDE=y
CONFIG_LTE_LC_PDN_DEFAULT_FAM_IPV4=y

Try these and let us know if it works. Thanks

Best Regards,
Syed Maysum

RE: https_client sample: connection refused

ao38 — Thu, 23 Apr 2026 14:55:46 GMT

Hi Syed,

Thank you very much for this thorough response, I tried changing the certificate, setting CONFIG_HTTPS_HOSTNAME in prj.conf as you proposed.

I am getting this log:

*** Booting nRF Connect SDK v3.2.2-74845e169be2 ***
*** Using Zephyr OS v4.2.99-fe4f0106803e ***
HTTPS client sample started
Bringing network interface up
Provisioning certificate
Certificate match
Connecting to the network
+CEREG: 2,"BD84","09A19608",7
+CSCON: 1
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
%MDMEV: SEARCH STATUS 2
+CEREG: 5,"BD84","09A19608",7,,,"11100000","11100000"
+CSCON: 0

It looks like the code is stucked on taking the network connected semaphore (NET_EVENT_L4_CONNECTED is never triggered).

I had a question concerning the modem initialization: how to choose if initialization is done at startup or by calling "nrf_modem_lib_init"? I don't see any particular line in the https_client example prj.conf file.

Thank you,

Arthur

RE: https_client sample: connection refused

Syed Maysum Abbas Zaidi — Thu, 23 Apr 2026 09:02:17 GMT

Hi,

It looks the network is registering, DNS resolves, and the modem is fine. The only reason the sample failed against example.com is a certificate mismatch with that specific server. Since you are connecting to an AWS endpoint, here is what you need:

First download the Amazon Root CA 1 certificate: https://www.amazontrust.com/repository/AmazonRootCA1.pem, place it in the cert/ folder, replacing DigiCertGlobalG3.pem.

Then update CMakeLists.txt, change the cert filename from DigiCertGlobalG3.pem to AmazonRootCA1.pem (and the .inc name to match). Also update src/main.c line 47, change the #include to "AmazonRootCA1.pem.inc".

Moreover you would need to add CONFIG_HTTPS_HOSTNAME="*******.eu-west-1.amazonaws.com" (your actual server hostname) to prj.conf

You may try getting the connection working on LTE-M first with these changes. Once that is confirmed, switching to NB-IoT is just one additional line in prj.conf (CONFIG_LTE_NETWORK_MODE_NBIOT=y), but first check that your iBASIS SIM has NB-IoT coverage in your country here: https://ibasis.com/solutions/iot-connectivity/network-coverage/

Point to note that France shows LTE-M only on the iBASIS coverage map, I am afraid that for NB-IoT you may need a different SIM (maybe from French operator). The iBASIS test SIM won't work for NB-IoT in France.

Let us know how it goes.

Best Regards,
Syed Maysum

RE: https_client sample: connection refused

Achim Kraus — Wed, 22 Apr 2026 15:16:01 GMT

OK. So you use the "nrf/samples/net/https_client" and you didn't modify it?

If so, I guess it fails, because the used trusted certificate in the sample is from www.digicert.com, while currently "example.com" uses SSL.com .

You may try it with the SSL.com root:

but I don't know, if that works.

RE: https_client sample: connection refused

ao38 — Wed, 22 Apr 2026 14:26:37 GMT

As I said in my first my message, I tried to use the sdk-nrf example https_client that's why the hostname is not the same as the one for my application... I just wanted to test if connection is even possible in my lab that's all.

RE: https_client sample: connection refused

Achim Kraus — Wed, 22 Apr 2026 14:22:43 GMT

From your first message:

+CEREG: 5,"BD84","09A19608",7,,,"11100000","11100000"
Network connectivity established and IP address assigned
Looking up example.com
Resolved 172.66.147.243 (AF_INET)
Connecting to example.com:443
connect() failed, err: 111

From the last message:

The actual server hostname is something like *******.eu-west-1.amazonaws.com

What I see:

> +CEREG: 5,"BD84","09A19608",7,,,"11100000","11100000"
> Network connectivity established and IP address assigned

device has registered successfully in the mobile network

> Looking up example.com
> Resolved 172.66.147.243 (AF_INET)

Your destination is "example.com"

> The actual server hostname is something like *******.eu-west-1.amazonaws.com

But "example.com" is not "eu-west-1.amazonaws.com".

[quote userid="149180" url="~/f/nordic-q-a/127869/https_client-sample-connection-refused/565290"]the TLS handshake failed, most commonly due to a certificate mismatch. [/quote]

The is pretty frequently the reason, when connecting to a different server. You would need to trust the proper CA (anchor certificate).

RE: https_client sample: connection refused

ao38 — Wed, 22 Apr 2026 11:37:12 GMT

Hi,

Thank you very much for the quick answers Syed Maysum Abbas Zaidi Achim Kraus !

1. The actual server hostname is something like *******.eu-west-1.amazonaws.com

2. I use the test SIM card provided by Nordic (IBASIS), I was thinking maybe there are restrictions with this plan?

3. The modem firmware version is: mfw_nrf9160_1.3.7

Also the radio conditions are not very good in our lab...

Thank you,

Arthur

RE: https_client sample: connection refused

Syed Maysum Abbas Zaidi — Wed, 22 Apr 2026 09:10:48 GMT

Hi,

Thanks for the detailed information. Before we suggest any changes, a few quick questions:

1. What is the hostname of your actual target server?
2. Which SIM/operator are you using, and do you know if NB-IoT is supported on it?
3. What modem firmware version are you on? You can check by running AT+CGMR via the AT Client sample.

On your nrf_modem_lib_init() question, you don't need to call it explicitly when using the https_client sample. The board configuration for the nRF9160 DK handles modem initialization automatically in the background.

Regarding the connect() failed, err: 111, this error on the nRF9160 typically means the TLS handshake failed, most commonly due to a certificate mismatch. Let us know the answers above and we'll get you to a working HTTPS POST over NB-IoT with minimal changes.

Best Regards,
Syed Maysum

RE: https_client sample: connection refused

Achim Kraus — Wed, 22 Apr 2026 07:07:01 GMT

[quote userid="145055" url="~/f/nordic-q-a/127869/https_client-sample-connection-refused"]I must admit I am quite lost on which libraries to use (zephyr vs nrf) to setup Nb-IOT vs Lte-M and TLS.[/quote]

The common setup is:

TCP/TLS is done by the modem's firmware

NCS comes with the additional libraries to use the modem

zephyr is the framework to use it.

So you use both zephyr and NCS.

A special setup uses

TCP by the modem's firmware

TLS by zephyr

If that helps, is more a question, which issues you faced with the common approach.

In general:

NB-IoT would only support TCP/TLS on pretty good radio conditions. If the signals goes low, the RTT goes up and that may break TCP.