NRF9160 FOTA over HTTPS

[fastfox]

Hi,

I've been skimming through the NRF9160 FOTA samples and related libraries(1.1 and master) and having hard time to understand some of the basics.

My assumptions are:

1) It looks like fota_download library does not support TLS at all(sec_tag is hard-coded to -1)

2) download_client does support TLS, but e.g. HTTP header is hard-coded

So if in my case if I would like to download binary over HTTPS and authenticate e.g. with api-key set in HTTP header, that looks like mission impossible with the current libraries. Is this true or did I misunderstood something. And if this is true, can you share the "roadmap" of the development of these libraries? I am just wondering whether I should fork them and butcher them to fit my needs or maybe wait/contribute to get them more flexible or something.

Thanks

[Martin Lesund]

Hi Fastfox,

By default, the FOTA download library uses HTTP for downloading the firmware file.

To use HTTPS instead, apply the changes described in the HTTPS section of the download client documentation to the library.

[fastfox]

Hi,

Thanks for prompt reply.

So basically the answer is that I should butcher fota lib to get HTTPS and butcher download client to get the headers, right?

What about the roadmap. IMHO, those libraries should have APIs that can be used to configure such stuff instead of having to fork and rewrite the code.

[Martin Lesund]

Hi Fastfox,
Thank you for pointing that out. 

By the way, we happily would like contributions to expand our libraries in NCS so that the libraries can be more flexible for your use-case.
(Ther is a Pull request on the User Guide on how developers can contribute to NCS)

There was just pushed out a Pull request based on what you have mentioned:

• Add option to define security tag for TLS

---

If you need more control over how the HTTP requests look like, then
a suggestion is that you could build your own FOTA library based on HTTP_CLIENTand in a combination with the DFU TARGET. 

[fastfox]

Yep, thanks. That is pretty much what I have been trying to do for few hours now.

Just struggling with unknown CA problems, even though there is another active TLS connection using the same CA cert while download client TLS fails. But that is another story.