nodeMCU TLS certificate error

Question

I am building realy simple IoT project, and I am stuck on nodeMCU TLS problem. I have MQTT broker on my Raspberry pi, all certificates are correctly inserted (everything working fine with Paho Client on same raspberry or with Mqtt.fx client on remote PC), but when I try to connect from my ESP8266 with nodeMCU I am getting SSL handshake error (yes, I am using same cert file for all mentioned clients). My ESP8266 code looks like this:

    tls.cert.verify([[
    -----BEGIN CERTIFICATE-----
    -----END CERTIFICATE-----
    ]])

    m:connect(config.HOST, 8883, 1, function(con) 
        print("Connected to MQTT broker")    
        register_myself()
        -- And then pings each 1000 milliseconds
        tmr.stop(6)
        tmr.alarm(6, 1000, 1, send_ping)
    end, handle_mqtt_error)

I am getting error code -5 (mqtt.CONN_FAIL_SERVER_NOT_FOUND) from m:connect, but when I analyze packets using Wireshark it TLS handshake looks like this:

Client Hello

Server Hello

Certificate, Server Hello Done

TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Unknown CA)

Also in ESPlorer console there is this line: E:M 544, I dont realy know what that means.

Create a new custom firmware and turn debug "logging" on (over serial). With near certainty you'll see an error code from the mbedTLS library which you then can look up at github.com/nodemcu/nodemcu-firmware/blob/master/app/include/…. — Marcel Stör
Thanks for your input! I have tried that and got an "handshake failure" message with an error code 0x2700... I am bit confused, because it is not in docs (or atleast I cant see it) — Pogasta
Are you aware of the constraints wrt cipher suites documented at nodemcu.readthedocs.io/en/latest/en/modules/tls? Could it be that your cert uses an unsupported/disabled cipher suite which you'd first need to configure in github.com/nodemcu/nodemcu-firmware/blob/master/app/include/…? Did you query tls.mbed.org/discussions for that error code? — Marcel Stör

Pogasta Pogasta · Accepted Answer · 2018-07-30T13:57:33

In case someone encountres same thing, my problem was actualy caused by high memory usage in other parts of my project, I used AES for encryption on application layer, without it everything works great.

nodeMCU TLS certificate error

2 Answers