HL7812 DTLS and config

[hkiol]

I am trying to connect to the Cumulocity LWM2M server via these commands and the HL7812:

AT+KSSLCRYPTO=0,8,3,25392,12,4,3,0
OK

AT+KUDPCFG=1,3,0,0,“lwm2m.eu-latest.cumulocity.com”,5784
+KUDPCFG: 1
OK
+KCNX_IND: 1,1,0

I am not getting the KUDP_IND response like I always do with the non secure alternative.

Any suggestions?

thanks

[jyijyi]

Didn’t it show connected for “+KCNX_IND: 1,1,0”?

How about setting auth to be zero in +sslcrypto?

How about testing with HTTPS protocol?

[hkiol]

Don’t we need the KUDP_IND response to send data? When I send data without it I get:

Error due to invalid state of terminate port data mode

I am using the latest firmware downloaded via AirVantage.

When I choose auth = 0 I get Bad session ID

I am not planning on using the HTTPS protocol so I’d prefer to not touch it at the moment.

[jyijyi]

Testing with https can at least let you know if the certificate is ok
You can see here:

Hl7800 khttp_error: 1,5

I think I am making progress but still not there yet. I have successfully loaded the certificate as per your instructions and the behaviour is different as follows:- AT+KHTTPCFG=1,“myurl”,443,2,0 +KHTTPCFG: 1 OK +KCNX_IND: 1,1,0 +KHTTP_ERROR: 1,5 I also keep getting CME ERROR:92 Error due to invalid state of session - what dies this mean and how can it be addressed.

Btw, are you using the latest firmware?

https://source.sierrawireless.com/resources/airprime/software/hl781x-and-hl7845-firmware/hl781x-release-6,-d-,2/

[jyijyi]

you can also test secure TCP socket, I saw other user can make it work to receive data from server, so that means the certificate is OK:

Data stuck in modem until remote closes connection

I managed to reproduce the issue with a TLS connection to a local TCP server. I generate a self-signed certificate with this command: openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes I run the TLS server with this python script: import socket import ssl import time import os # Server configuration HOST = '0.0.0.0' PORT = 443 # Port to listen on CERT_FILE = 'server.crt' # Path to the server's certificate file KEY_FILE = 'server.key' # Path to …

[hkiol]

Hi again,

I have been informed that the LWM2M server uses and sends as the ServerHello a self-signed certificate which doesn’t have a CA.

My device then sends Fatal Alert Unknown CA message.

Is this info helpful for you to pinpoint what the issue is?

I have successfully created the root CA and the device cert and key and loaded all of them onto the HL modem.

thanks

[jyijyi]

as mentioned before, have you tested with HTTPS server or secure TCP socket?

[hkiol]

The connection is being denied during the TLS handshake, before any HTTPS or secure TCP protocol layer is reached.

That’s why I shared the new information about the server presenting a self-signed certificate with no CA. The modem is rejecting it with Fatal Alert: Unknown CA, so the session is terminated before HTTPS or DTLS can come into play.

I was hoping this detail would help narrow the issue down to certificate trust rather than the higher-level protocol.

TCP approach:

AT+KCNXCFG=1,"GPRS","iot.1nce.net"

OK
AT+KSSLCRYPTO=0,8,3,25392,12,4,3,0

OK
AT+KTCPCFG=1,3,"lwm2m.eu-latest.cumulocity.com",5784

+KTCPCFG: 1

OK
AT+KTCPCNX=1

OK

+KCNX_IND: 1,1,0

+KTCP_NOTIF: 1,13

thanks

[jyijyi]

i remember for one-way authentication, a server must have CA certificate + server certificate and client needs to have the CA certificate
for mutual authentication, the server must have CA certificate + server certificate and client needs to have the CA certificate + client certificate.

So I would suggest you to set up your own HTTPS and secure TCP server to verify

Btw, have you tried to set +ksslcryto to use server authentication instead of mutual authentication?

Furthermore, i saw your +ktcpcfg is not specifying the profile for ssl…