Https fota fails on a specific site

RE: Https fota fails on a specific site

Didrik Rokhaug — Thu, 11 Feb 2021 09:32:30 GMT

Hi, and sorry for the very late reply.

I ran your server through SSLabs.com, and it doesn't look like your server supports any of the cipher suites supported by the nRF9160.

Your server therefore rejects the TLS connection.

You can find the list of supported cipher suites on our website.

Best regards,

Didrik

RE: Https fota fails on a specific site

MosheSmartAmr — Tue, 02 Feb 2021 08:13:02 GMT

Hi,

I pulled the certificate from firefox, and still I was unable to connect

this is the certificate I got:

any idea how to debug this ?

RE: Https fota fails on a specific site

Didrik Rokhaug — Mon, 01 Feb 2021 13:16:50 GMT

Hi, and sorry for the late reply.

[quote user="MosheSmartAmr"]How do I know what is the right certificate.[/quote]

There are many ways, including using your browser (e.g. click on the padlock in the URL field in Firefox), or you can use openssl as explained here: https://stackoverflow.com/questions/7885785/using-openssl-to-get-the-certificate-from-a-server

[quote user="MosheSmartAmr"]as I understand the certificate in the code is a global certificate.[/quote]

Typically, a server will have a chain of certificates, and if one of the certificates in the chain matches a "known and trusted" certificate, the connection is established.

Web browsers typically has a set of certificates from certificate authorities which are trusted. A server would then ask one of the certificate authorities to sign its certificate, so web browsers can connect to the server.

However, in the case of the nRF91, we currently only support one CA certificate at a time. This means that if the server's certificate isn't signed by the trusted CA certificate, the connection will be rejected. In your case, it seems your server's certificate has been signed by a different certificate authority than CyberTrust.

RE: Https fota fails on a specific site

MosheSmartAmr — Tue, 26 Jan 2021 15:30:33 GMT

Hi,

How do I know what is the right certificate.

as I understand the certificate in the code is a global certificate.

the Domain is,

https://esr.etrogsystems.com/

RE: Https fota fails on a specific site

Didrik Rokhaug — Tue, 26 Jan 2021 14:47:54 GMT

Hi,

Does the HTTPS website use the same certificates as the S3 bucket, or have you provisioned the right certificates to the device?

Best regards,

Didrik