Some root CA certificates do not work.

[Steven]

Using the HTTPS sample, the following do or don't work:

1) out-of-the box (google.com) works.
2) change CA certificate to the root for www.apple.com and connecting to www.apple.com, works.
3) change CA certificate to the root for www.signetk.com and connecting to www.signetik.com, fails.

Error:

HTTPS client sample started
Provisioning certificate
Waiting for network.. OK
Connecting to www.signetik.com
connect() failed, err: 45 

root CA:

➜ cat DS-Root-CA-X3
"-----BEGIN CERTIFICATE-----\n"
"MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/\n"
"MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\n"
"DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow\n"
"PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD\n"
"Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\n"
"AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O\n"
"rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq\n"
"OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b\n"
"xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw\n"
"7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD\n"
"aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV\n"
"HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG\n"
"SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69\n"
"ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr\n"
"AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz\n"
"R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5\n"
"JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo\n"
"Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ\n"
"-----END CERTIFICATE-----\n"

[Didrik Rokhaug]

Hi,

What modem firmware and SDK version are you using?

Does your server require SNI support? If so, you must use modem firmware version v1.2.1.

If that does not help, could you take a modem trace?

Best regards,

Didrik

[Steven]

Using 1.2.0 and NCS 1.2

I will try 1.2.1 and do a modem trace. Thanks!

[Steven]

Also, when I do logging on the server (DEBUG level) I never see a TLS connection started in this case. I see it if I use wget.

[Didrik Rokhaug]

Does the server report the connection attempt at all? If so, does it give any indication about why the connection failed?

I ran your server through ssllabs.com: https://www.ssllabs.com/ssltest/analyze.html?d=www.signetik.com&hideResults=on

None of the cipher suites listed as supported is supported by the nRF9160.

You can see the list of supported TLS cipher suites on the nRF9160 product page. Does your server support any of those cipher suites?

[Steven]

Thanks Didrik, we have solved this and it is no longer issue. It is as you said. Sorry to take long to close this out.