Download Client Library not connecting again after few attempt(s)

[Aziz]

Hi,

I am using the download client library (MFW 1.1.4 due to Verizon compatibility) and am noticing that the TLS handshake with my server only succeeds after the first few attempts after a system reboot. I modified the HTTPS Download Client sample by tying the function to a button interrupt. I get the error "<err> download_client: Unable to connect, errno 22".

I ran openssl for debugging like so on my server:

openssl  s_server -accept 443 -key server.key -cert server.crt -CAfile ca.crt -verify_return_error -Verify 2 -state

And got this output when my device connected to my server (failed attempt):

ACCEPT
SSL_accept:before SSL initialization
SSL_accept:before SSL initialization
SSL_accept:SSLv3/TLS read client hello
SSL_accept:SSLv3/TLS write server hello
SSL_accept:SSLv3/TLS write certificate
SSL_accept:SSLv3/TLS write key exchange
SSL_accept:SSLv3/TLS write certificate request
SSL_accept:SSLv3/TLS write server done
SSL_accept:SSLv3/TLS write server done
depth=1 CN = TestCA
verify return:1
depth=0 CN = TestClient_1
verify return:1
SSL_accept:SSLv3/TLS read client certificate
SSL_accept:error in SSLv3/TLS read client key exchange
ERROR
shutting down SSL
CONNECTION CLOSED

When it is successful, I get a response similar to that shown in https://www.golinuxcloud.com/mutual-tls-authentication-mtls/ 

Seems the client key exchanging is failing, causing the TLS handshake to fail. Any ideas why? Must I reset any of the data structurers in the download_client library?

Otherwise, this may be suggestive of a bug.

Thanks

[Charlie]

Hi Aziz,

They are two points you may need to check:

1) SSLv3 (aka TLS 1.0) is long deprecated and has some security issues, so you should disable SSLv3 (disablessl3.com) on your server. The version of mbedTLS is 2.6.0 according to Zephyr Kernel 1.9.2 Documentation which is used by NCS1.8.0, so you need to switch to a newer TLS at least 1.2(refer to mbed TLS protocol support table from Comparison of TLS implementations).

2) Since the latest NCS1.8.0 is not tested with MFW1.1.4 according to Compatibility Matrix, it would be better practice to test with the correct MFW version to avoid struggling with compatibility issues.

Best regards,

Charlie