nrf9160 https certificate

[kamacode]

I am using the https fota, aws sample OK.

testd the aws certificate via Linux PC this way: 

openssl s_client -connect kamacodeetrog.s3.us-east-2.amazonaws.com:443

now I want to move the app_update.bin to my server

https://esr.etrogsystems.com/static/mqtt_updateapp_update.bin

so, I tested the server and got the certificate:

openssl s_client -connect esr.etrogsystems.com:443

so in the http fota example I used server name as:

esr.etrogsystems.com

and file name as: static/mqtt_update/app_update.bin

however I get certificate error.

what am I missing ? 

[Øyvind]

Hello, 

Can you please provide the errors you are receiving? Have you added the certificates to your device?

Kind regards,
Øyvind

[kamacode]

1. this is the error I get : 

[00:01:36.791,229] <wrn> download_client: No security tag provided for TLS/DTLS.

2. I replaced the certificate of course 

[Øyvind]

How did you provision the certificate on the device? What security tag did you add it to?

[kamacode]

I copied the cert file under "cert" directory, and of course set the certificate new correct file name in the code. that is all I did 

[Øyvind]

What sample did you use, HTTPS Client or AWS FOTA? Can you please provide full output from your device?

Under AWS Fota documentation you will find the CLOUD_CERT_SEC_TAG where the certificate is stored. You need to configure this in your prj.conf along with CONFIG_PROVISION_CERTIFICATES

The KConfig states:

config PROVISION_CERTIFICATES
	depends on !USE_NRF_CLOUD
	bool "Provision certificates from the certificates.h file"
	select MODEM_KEY_MGMT
	default n
	help
	  If enabled, the sample provisions server certificates into
	  the modem by storing the certificates defined in the
	  certificates.h file in the modem under the given security tag.
	  Use this option only once to provision the device.
	  The certificates are stored in the application binary and are
	  therefore shown in the modem trace information. This is a
	  security risk. After provisioning the certificates, turn off
	  this option and compile and program the sample again.
	  Also, do not share the binary that includes the compiled
	  certificates with anyone.

config CLOUD_CERT_SEC_TAG
	depends on !USE_NRF_CLOUD
	int "Security tag for TLS credentials"
	default 12345678

CONFIG_PROVISION_CERTIFICATES=y
CONFIG_CLOUD_CERT_SEC_TAG=nn