https client connection problem

[chapman]

Hi , 

I am using nrf connect 1.2.0 dk. I am now testing the https client example. 

However, I always get the connection fail error as belows. 

Provisioning certificate

Waiting for network.. OK

Connecting to google.com

connect() failed, err: 45

"To connect to other servers, you might need to provision a different certificate. You can download a certificate for a given server using your web browser. Alternatively, you can obtain it from a dedicated website like SSL Labs."

According to the instruction, I download a certificate from the https://www.ssllabs.com/ssltest/

I submitted a query of "google.com" in that website and download a pem. 

I also add back those double quotation and newline character to the pem. However, the results are same. 

Besides, I also change the NBIOT without epco setting in the configuration which is workable in other example .

My questions is:

How can I get a correct certificate?

How can I download directly via web browser?

Thank you.

Regards, 

Chapman

[Didrik Rokhaug]

Hi.

The sample works for me without any modifications. As the sample comes with the necessary certificate, it should not be necessary to download a new certificate.

One check you can do is to see if the certificate you downloaded matches the one used by the sample by default.

Are you using LTE-M or NB-IoT?

What verion on the modem firmware are you using?

Have you been able to use other samples that use TCP/TLS on your network (e.g. the asset_tracker sample)?

Can you take a modem trace, to help me identify the problem?

If you do not know how to take a modem trace, you can follow this guide: https://devzone.nordicsemi.com/nordic/nordic-blog/b/blog/posts/how-to-get-modem-trace-using-trace-collector-in-nrf-connect

Best regards,

Didrik

[chapman]

I have tried again with original certificate but it still got the same result. 

connect() failed, err: 45

I am using NB-IoT with modem firmware version: mfw_nrf9160_1.1.1

Asset tracker is workable in our network. 

I have set two things in project configuration: NB-Iot and Legacy PCO. 

Modem trace is attached. Thank you.

trace-2020-03-13T02-39-26.454Z.bin

[Didrik Rokhaug]

Thanks.

Looking at the trace, there is something going wrong during the TLS handshake. I am working with the modem team to figure out exactly what.

I will let you know when I have more information.

[Didrik Rokhaug]

The problem seems to be related to the network.

Your trace shows that the connection gets reset during the TLS handshake, which in turn causes the connect to fail.

When looking further into the trace, I find several lines where the modem reports "No PLMN action allowed".

Can you try to read out the certificate that is written to the modem?

The AT command would be: AT%CMNG=2,42,0

Edit: Note that the modem must be disabled (CFUN=4) when sending the command

The output should match the CA certificate of google.com. If it does not, that would explain the error.

What SIM card are you using?

Are you using the same network (NB-IoT, and legacy PCO) and SIM card when running the asset_tracker sample?

Could you take a modem trace of that as well for me to compare?

[chapman]

After I reload the certificate which is downloaded from nrf cloud. It can run properly in asset tracker example and https_client example.  Does it mean that the nrf cloud certificate is required for https_client example? 

[Didrik Rokhaug]

No, the nRF Cloud CA certificate should not be necessary to run the https_client sample.

However, I can imagine that if the nRF Cloud certificate somehow got corrupted, and thereby corrupted the filesystem used to store the certificates, that might explain why re-writing the nRF Cloud certificate lets you run the https_client sample.

Anyway, good to hear that it is now working!