nRF93M1 HTTP client fails to download HTTPS file from GitHub with %HTTP ERROR: 19

Description
===========

I am trying to use the native HTTP/HTTPS AT commands of the nRF93M1 to
download a firmware image for an external host MCU.

Hardware and software
---------------------

- Development kit: nRF93M1 DK, PCA10232 revision 0.4.0
- nRF93M1 modem firmware: mfw_nrf93m1_1.4.1
- Host MCU application: nRF Connect SDK v3.3.0
- Zephyr OS: v4.3.99
- UART communication between the host MCU and nRF93M1
- LTE Cat 1 bis registration and PDP context activation succeed
- The HTTP operation is performed before CMUX and PPP are enabled

Firmware URL
------------

raw.githubusercontent.com/.../fw.bin

File information
----------------

Size: 353964 bytes

SHA-256:
ffc547b5edb80e57ff84144a7b28aa171bc228de6697dfd093badaa4cf35c5bd

The URL works correctly from a PC and returns:

HTTP/1.1 200 OK
Content-Length: 353964
Content-Type: application/octet-stream
Accept-Ranges: bytes

Steps to reproduce
==================

The modem is placed in flight mode first, the SIM is checked, and then LTE
is enabled:

AT+CFUN=4
AT+CPIN?
AT+CEREG=5
AT+CGEREP=1
AT+CFUN=1

Network registration and PDP context activation are successful:

+CGEV: ME PDN ACT 1
+CEREG: 1,"32C9","04A7C920",7

AT+CGPADDR=1
+CGPADDR: 1,"6.224.170.255"
OK

The SSL and HTTP contexts are configured as follows:

AT%SSLCFG="seclevel",0,0
OK

AT%SSLCFG="sni",0,1
OK

AT%HTTPCFG="sslctxid",0
OK

AT%HTTPCFG="contextid",1
OK

The URL length is 66 bytes:

AT%HTTPURL=66,60
CONNECT

raw.githubusercontent.com/.../fw.bin

OK

A range request for the first 1024 bytes is then started:

AT%HTTPGETEX=0,1024
OK

When reading the HTTP response, the modem returns SSL error 19:

AT%HTTPREAD

%HTTP ERROR: 19

Complete relevant log
=====================

nRF93 > AT+CGMR

nRF93 < mfw_nrf93m1_1.4.1

nRF93 < OK


nRF93 > AT+CFUN=4

nRF93 < OK
Waiting 2000 ms for flight mode...


nRF93 > AT+CPIN?

nRF93 < +CPIN: READY

nRF93 < OK


nRF93 > AT+CGSN=1

nRF93 < +CGSN: "<IMEI>"

nRF93 < OK


nRF93 > AT+CEREG=5

nRF93 < OK


nRF93 > AT+CGEREP=1

nRF93 < OK


nRF93 > AT+CFUN=1

nRF93 < OK

nRF93 < +CEREG: 2

nRF93 < +CGEV: ME PDN ACT 1

nRF93 < +CEREG: 1,"32C9","04A7C920",7


nRF93 > AT+CGPADDR=1

nRF93 < +CGPADDR: 1,"6.224.170.255"

nRF93 < OK


nRF93 > AT%SSLCFG="seclevel",0,0

nRF93 < OK


nRF93 > AT%SSLCFG="sni",0,1

nRF93 < OK


nRF93 > AT%HTTPCFG="sslctxid",0

nRF93 < OK


nRF93 > AT%HTTPCFG="contextid",1

nRF93 < OK


nRF93 > AT%HTTPURL=66,60

nRF93 < CONNECT

nRF93 < OK


nRF93 > AT%HTTPGETEX=0,1024

nRF93 < OK


nRF93 > AT%HTTPREAD

nRF93 < %HTTP ERROR: 19

Details in the attached file.


Hardware and software
---------------------

- Development kit: nRF93M1 DK, PCA10232 revision 0.4.0
- nRF93M1 modem firmware: mfw_nrf93m1_1.4.1
- Host MCU application: nRF Connect SDK v3.3.0
- Zephyr OS: v4.3.99
- UART communication between the host MCU and nRF93M1
- LTE Cat 1 bis registration and PDP context activation succeed
- The HTTP operation is performed before CMUX and PPP are enabled

Firmware URL
------------

https://raw.githubusercontent.com/kietpt2704/fota_test/main/fw.bin

File information
----------------

Size: 353964 bytes

SHA-256:
ffc547b5edb80e57ff84144a7b28aa171bc228de6697dfd093badaa4cf35c5bd

The URL works correctly from a PC and returns:

HTTP/1.1 200 OK
Content-Length: 353964
Content-Type: application/octet-stream
Accept-Ranges: bytes

Steps to reproduce
==================

The modem is placed in flight mode first, the SIM is checked, and then LTE
is enabled:

AT+CFUN=4
AT+CPIN?
AT+CEREG=5
AT+CGEREP=1
AT+CFUN=1

Network registration and PDP context activation are successful:

+CGEV: ME PDN ACT 1
+CEREG: 1,"32C9","04A7C920",7

AT+CGPADDR=1
+CGPADDR: 1,"6.224.170.255"
OK

The SSL and HTTP contexts are configured as follows:

AT%SSLCFG="seclevel",0,0
OK

AT%SSLCFG="sni",0,1
OK

AT%HTTPCFG="sslctxid",0
OK

AT%HTTPCFG="contextid",1
OK

The URL length is 66 bytes:

AT%HTTPURL=66,60
CONNECT

https://raw.githubusercontent.com/kietpt2704/fota_test/main/fw.bin

OK

A range request for the first 1024 bytes is then started:

AT%HTTPGETEX=0,1024
OK

When reading the HTTP response, the modem returns SSL error 19:

AT%HTTPREAD

%HTTP ERROR: 19

Complete relevant log
=====================

nRF93 > AT+CGMR

nRF93 < mfw_nrf93m1_1.4.1

nRF93 < OK


nRF93 > AT+CFUN=4

nRF93 < OK
Waiting 2000 ms for flight mode...


nRF93 > AT+CPIN?

nRF93 < +CPIN: READY

nRF93 < OK


nRF93 > AT+CGSN=1

nRF93 < +CGSN: "<IMEI>"

nRF93 < OK


nRF93 > AT+CEREG=5

nRF93 < OK


nRF93 > AT+CGEREP=1

nRF93 < OK


nRF93 > AT+CFUN=1

nRF93 < OK

nRF93 < +CEREG: 2

nRF93 < +CGEV: ME PDN ACT 1

nRF93 < +CEREG: 1,"32C9","04A7C920",7


nRF93 > AT+CGPADDR=1

nRF93 < +CGPADDR: 1,"6.224.170.255"

nRF93 < OK


nRF93 > AT%SSLCFG="seclevel",0,0

nRF93 < OK


nRF93 > AT%SSLCFG="sni",0,1

nRF93 < OK


nRF93 > AT%HTTPCFG="sslctxid",0

nRF93 < OK


nRF93 > AT%HTTPCFG="contextid",1

nRF93 < OK


nRF93 > AT%HTTPURL=66,60

nRF93 < CONNECT

nRF93 < OK


nRF93 > AT%HTTPGETEX=0,1024

nRF93 < OK


nRF93 > AT%HTTPREAD

nRF93 < %HTTP ERROR: 19

Alternative tests
=================

I also tested the following sequence:

AT%HTTPGET
OK

AT%HTTPREADFILE="fw.bin"
%HTTP ERROR: 19

The result was the same.

I tested both SSL context 0 and SSL context 1. The SSL context 1
configuration was:

AT%SSLCFG="seclevel",1,0
AT%SSLCFG="sni",1,1
AT%HTTPCFG="sslctxid",1

Both contexts produced %HTTP ERROR: 19.

Cipher compatibility observation
================================

According to the nRF93M1 Cellular AT Commands v0.9 manual, the documented
configurable cipher suites are:

0xC0AD - TLS_ECDHE_ECDSA_WITH_AES_256_CCM
0xC09F - TLS_DHE_RSA_WITH_AES_256_CCM

I tested both cipher suites against raw.githubusercontent.com using OpenSSL:

openssl s_client -connect raw.githubusercontent.com:443 \
  -servername raw.githubusercontent.com \
  -tls1_2 \
  -cipher ECDHE-ECDSA-AES256-CCM

and:

openssl s_client -connect raw.githubusercontent.com:443 \
  -servername raw.githubusercontent.com \
  -tls1_2 \
  -cipher DHE-RSA-AES256-CCM

Both tests were rejected by the server with:

ssl/tls alert handshake failure
SSL alert number 40

This suggests that %HTTP ERROR: 19 may be caused by the lack of a mutually
supported TLS cipher suite. However, I would like Nordic to confirm whether
this is the actual limitation or whether additional SSL configuration is
required.

Questions
=========

1. Is raw.githubusercontent.com compatible with the native HTTPS client in
   mfw_nrf93m1_1.4.1?

2. Does modem firmware 1.4.1 support additional TLS cipher suites that are
   not listed in the AT command manual?

3. Is the command sequence %HTTPGETEX followed by %HTTPREAD correct?

4. Is there any way to obtain more detailed information about
   %HTTP ERROR: 19?

5. Is there a newer nRF93M1 modem firmware with broader TLS cipher-suite
   support?

6. Can the native HTTP client follow an HTTP 301/302 redirect from HTTP to
   HTTPS?

7. For host-MCU FOTA, is using an HTTP port 80 server currently the only
   practical solution when the HTTPS server does not support the modem's CCM
   cipher suites?

Reference
=========

nRF93M1 Cellular AT Commands v0.9:
https://www.nordicsemi.com/-/media/Software-and-other-downloads/Product-Briefs/nrf93m1_cellular_at_commands_v0.9.pdf

Related