HTTPS connection using AT#XHTTPCCON fails to connect to server

[EmbeddedDan]

I'm using the serial_lte_modem application from Tag v1.5.0-rc1, on the nrf9160dk evaluation board to make a secure connection to google.com but it returns #XHTTPCCON:0.

The local service provider uses NB-Iot and I'm able to connect to a server using a none secure connection.

Could you please look at the evidence and remark on what I'm doing wrong?

The CA certificate is loaded in the modem certificate storage. No other certificates are loaded.

AT%CMNG=2,42,0
%CMNG: 42,0,"0000000000000000000000000000000000000000000000000000000000000000","-----BEGIN CERTIFICATE-----
MIIDujCCAqKgAwIBAgILBAAAAAABD4Ym5g0wDQYJKoZIhvcNAQEFBQAwTDEgMB4G
A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp
Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1
MDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG
A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAKbPJA6+Lm8omUVCxKs+IVSbC9N/hHD6ErPL
v4dfxn+G07IwXNb9rfF73OX4YJYJkhD10FPe+3t+c4isUoh7SqbKSaZeqKeMWhG8
eoLrvozps6yWJQeXSpkqBy+0Hne/ig+1AnwblrjFuTosvNYSuetZfeLQBoZfXklq
tTleiDTsvHgMCJiEbKjNS7SgfQx5TfC4LcshytVsW33hoCmEofnTlEnLJGKRILzd
C9XZzPnqJworc5HGnRusyMvo4KD0L5CLTfuwNhv2GXqF4G3yYROIXJ/gkwpRl4pa
zq+r1feqCapgvdzZX99yqWATXgAByUr6P6TqBwMhAo6CygPCm48CAwEAAaOBnDCB
mTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUm+IH
V2ccHsBqBt5ZtJot39wZhi4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5n
bG9iYWxzaWduLm5ldC9yb290LXIyLmNybDAfBgNVHSMEGDAWgBSb4gdXZxwewGoG
3lm0mi3f3BmGLjANBgkqhkiG9w0BAQUFAAOCAQEAmYFThxxol4aR7OBKuEQLq4Gs
J0/WwbgcQ3izDJr86iw8bmEbTUsp9Z8FHSbBuOmDAGJFtqkIk7mpM0sYmsL4h4hO
291xNBrBVNpGP+DTKqttVCL1OmLNIG+6KYnX3ZHu01yiPqFbQfXf5WRDLenVOavS
ot+3i9DAgBkcRcAtjOj4LaR0VknFBbVPFd5uRHg5h6h+u/N5GJG79G+dwfCMNYxd
AfvDbbnvRG15RjF+Cv6pgsH/76tuIMRQyV+dTZsXjAzlAcmgQWpzU/qlULRuJQ/7
TBj0/VLZjmmx6BEP3ojY+x1J96relc8geMJgEtslQIxq/H5COEBkEveegeGTLg==
-----END CERTIFICATE-----"

This is the AT commands I send to the modem using a script:

****************
Nordic AT Client
****************
COM /dev/ttyACM0 Open
AT
OK
AT#XSLMUART?
#XSLMUART: 115200
OK
AT+CFUN=0
OK
AT%XSYSTEMMODE=0,1,0,2
OK
AT%XBANDLOCK=1,"10000000"
OK
AT%XDEEPSEARCH=1
OK
AT+CGDCONT=0,"IP","nbiot.vodacom.za"
OK
AT+COPS=0
OK
AT+CEREG=5
OK
AT+CFUN=21
OK
AT%XICCID
ERROR
Check SIM
AT+CPIN="3349"
OK
+CEREG: 2,"5209","0A19790D",9,0,0,"11100000","11100000"
+CEREG: 1,"5209","0A19790D",9,,,"11100000","00000110"
AT%XICCID
%XICCID: 89330000000020549718
OK
Waiting 1 sec
AT#XHTTPCCON=1,"google.com",443,42
#XHTTPCCON:0
ERROR

Attached is a modem trace for your perusal

trace-2021-04-22T10-26-22.978Z.bin

[Heidi]

Hi!

First question, did you add CONFIG_SLM_HTTPC=y to the prj.conf file, to enable the HTTP module in the SLM application? 

In the meantime, I will take a look at the trace.

Best regards,

Heidi

[EmbeddedDan]

The serial_lte_modem application does have the necessary configurations set:

#
# Copyright (c) 2020 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
# General config
CONFIG_LOG=y
CONFIG_LOG_DEFAULT_LEVEL=3
CONFIG_STACK_SENTINEL=y
CONFIG_NEWLIB_LIBC=y
CONFIG_NEWLIB_LIBC_FLOAT_PRINTF=y
CONFIG_RING_BUFFER=y

# Segger RTT
CONFIG_USE_SEGGER_RTT=y
CONFIG_RTT_CONSOLE=y
CONFIG_UART_CONSOLE=n
CONFIG_LOG_BACKEND_RTT=y
CONFIG_LOG_BACKEND_UART=n

# Network
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_NATIVE=n

# Modem library
CONFIG_NRF_MODEM_LIB=y
# Align the max FD entry to NRF_MODEM_MAX_SOCKET_COUNT(8)
CONFIG_POSIX_MAX_FDS=8
# Enable below for modem trace
CONFIG_NRF_MODEM_LIB_TRACE_ENABLED=y

# Use GPIO
CONFIG_GPIO=y
CONFIG_GPIO_NRFX=y
CONFIG_GPIO_NRF_P0=y

# UART interface
CONFIG_SERIAL=y
CONFIG_UART_ASYNC_API=y
CONFIG_NRFX_TIMER2=y

# LTE link control
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=n

# Stacks and heaps
CONFIG_MAIN_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=16384
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096

# AT_CMD
# Enable AT_CMD debug for details
#CONFIG_AT_CMD_LOG_LEVEL_DBG=y
CONFIG_AT_CMD_RESPONSE_MAX_LEN=4096

# Device power management
CONFIG_DEVICE_POWER_MANAGEMENT=y

# Enable SUPL client support
#CONFIG_SUPL_CLIENT_LIB=y

# FOTA
CONFIG_HTTP_PARSER_URL=y
CONFIG_FOTA_DOWNLOAD=y
CONFIG_FOTA_DOWNLOAD_PROGRESS_EVT=y
CONFIG_DFU_TARGET=y
CONFIG_DOWNLOAD_CLIENT=y
CONFIG_DOWNLOAD_CLIENT_STACK_SIZE=4096
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_IMG_MANAGER=y
CONFIG_FLASH=y
CONFIG_IMG_ERASE_PROGRESSIVELY=y

#
# SLM-specific configurations
#
CONFIG_SLM_LOG_LEVEL_INF=y
# Configure external XTAL for UART
CONFIG_SLM_EXTERNAL_XTAL=n
# Enable GPIO wakeup if sleep is expected
#CONFIG_SLM_GPIO_WAKEUP=y
# Use UART_0 (when working with PC terminal)
CONFIG_UART_0_NRF_HW_ASYNC_TIMER=2
CONFIG_SLM_DATAMODE_HWFC=n
# Use UART_2 (when working with external MCU)
#CONFIG_SLM_CONNECT_UART_2=y
#CONFIG_UART_2_NRF_HW_ASYNC_TIMER=2

# Use optional GPS service
#CONFIG_SLM_GPS=y
# Use optional FTP client service
#CONFIG_SLM_FTPC=y
# Use optional MQTT client service
#CONFIG_SLM_MQTTC=y
# Use optional HTTP client service
CONFIG_SLM_HTTPC=y
# Enable Key Management Library
CONFIG_MODEM_KEY_MGMT=y

#Enable Debug symbols
CONFIG_DEBUG_OPTIMIZATIONS=y

[Heidi]

Thank you! I have forwarded it to the modem team for analysis. 

[Heidi]

Hi!

PR 4676 will fix the issue you're seeing.

Best regards,

Heidi

[EmbeddedDan]

Thanks Heidi

I have update the sdk & serial_lte_modem application to Tag v1.6.0-rc2 which includes PR4676

I have obtain a new nRF9160 Development Kit with a "B1" = Revision 2 modem and loaded Modem firmware mfw_nrf9160_1.3.0.
I'm running the same AT commands as before but fails when it calls the connect function in the resolve_and_connect function

[00:00:32.326,385] <inf> httpc: Attempting to connect over IPv6
[00:00:32.327,209] <inf> httpc: Setting up TLS credentials
[00:00:32.328,765] <err> httpc: Unable to connect, errno 114
[00:00:32.708,679] <inf> httpc: Attempting to connect over IPv4
[00:00:32.709,991] <inf> httpc: Setting up TLS credentials
[00:00:32.956,939] <err> httpc: Unable to connect, errno 116
[00:00:32.965,850] <err> httpc: Fail to resolve and connect
[00:00:32.965,850] <err> httpc: server_connect fail.

Here is the trace log:trace-2021-06-15T10-03-27.815Z.bin

[Heidi]

Unfortunately, there's not much information in the log. There are lots of traces missing like before.

1) A TCP connection is attempted and then 300 ms after that modem is deactivated when the response from the server might be still on its way.

Are you deactivating the modem on purpose that quickly?

2) Are you able to log the server-side? Is the TCP SYN from the modem visible in the server log?

 

[Heidi]

Hi, 

It looks like you are using the wrong syntax when connecting to the server:

AT#XHTTPCCON=1,"google.com",443,42"

 

The last quote is not required. It should be

AT#XHTTPCCON=1,"google.com",443,42

[EmbeddedDan]

Thanks yes I caught that typo