TLSv1.2 Client/Server Hello Handshake with Azure IoT Hub

[ghost]

Hello, I am attempting to connect a Nordic nRF52840-dk device to Azure IoT Hub with OpenThread v1.2. I am using v1.9.1 of the Nordic nRF Connect SDK.

My nRF52830-dk (client) exchanges TCP SYN->SYN,ACK->ACK messages with my IoT Hub (server, in the East US 2 Azure region) and then sends a TLSv1.2 "Client Hello" message. The "Client Hello" contains multiple cipher suites supported by IoT Hub per Microsoft's documentation. However, I do not get a "Server Hello" message back from the IoT Hub and the connection process hangs.

Is it more likely that my TLS configuration settings are incorrect or that I have otherwise misconfigured my OpenThread network and NAT64 route?

Excerpt of TLS-related prj.conf settings:

CONFIG_OPENTHREAD_NRF_SECURITY_CHOICE=n

#MBEDTLS and security configuration 
CONFIG_NORDIC_SECURITY_BACKEND=y
CONFIG_NRF_SECURITY=y
CONFIG_MBEDTLS_CFG_FILE="nrf-config-user-empty.h"
#^ pasted all of "nrf-config.h" contents into "nrf-config-user-empty.h", plus MBEDTLS date-time definitions and #define MBEDTLS_CIPHER_MODE_CBC
CONFIG_NET_TCP_ISN_RFC6528=n

#MBEDTLS Configuration cont'd
CONFIG_OPENTHREAD_MBEDTLS_CHOICE=n
#^ y allows use of MBEDTLS_BUILTIN
#^ n does not allow MBEDTLS_BUILTIN and uses NRF_SECURITY
CONFIG_MBEDTLS_TLS_VERSION_1_2=y
#CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y
#CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED=y
#CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED=y
CONFIG_MBEDTLS_CIPHER_MODE_CBC_ENABLED=y
#^from https://devzone.nordicsemi.com/f/nordic-q-a/86632/openthread-and-mqtt-over-tls-is-single-program

CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=n
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED=y
CONFIG_MBEDTLS_KEY_EXCHANGE_RSA_ENABLED=y
CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=y
CONFIG_MBEDTLS_CIPHER_AES_ENABLED=y
CONFIG_MBEDTLS_CIPHER_CCM_ENABLED=n
CONFIG_MBEDTLS_CIPHER_GCM_ENABLED=y
CONFIG_MBEDTLS_GCM_C=y

#Following needed to set CONFIG_MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED=y
CONFIG_MBEDTLS_DHM_C=y
CONFIG_MBEDTLS_RSA_C=y
CONFIG_MBEDTLS_X509_CRT_PARSE_C=y
CONFIG_MBEDTLS_PKCS1_V15=y

# TLS configuration
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_BUILTIN=n
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=64000
# certificate must fit into one message, fragmenting is not supported
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=10240
#CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT=y
CONFIG_MBEDTLS_PK_WRITE_C=y
CONFIG_MBEDTLS_CTR_DRBG_C=y
CONFIG_MBEDTLS_ECDSA_C=y
CONFIG_MBEDTLS_SHA256_C=y
#CONFIG_MBEDTLS_RSA_C=y #defined above already
CONFIG_MBEDTLS_AES_C=y
CONFIG_MBEDTLS_PKCS1_V21=y
#Credentials
CONFIG_TLS_CREDENTIALS=y
CONFIG_TLS_MAX_CREDENTIALS_NUMBER=4
#^from https://devzone.nordicsemi.com/f/nordic-q-a/86933/azure-iot-hub-library-with-openthread/377915

CONFIG_DATE_TIME=y
CONFIG_DATE_TIME_NTP=y

# Network
CONFIG_NETWORKING=y
CONFIG_NET_L2_OPENTHREAD=y
CONFIG_NET_IPV6_NBR_CACHE=n
CONFIG_NET_IPV6_MLD=n
CONFIG_NET_IPV6=y
CONFIG_NET_IPV4=n
CONFIG_NET_CONFIG_SETTINGS=y
CONFIG_NET_CONFIG_NEED_IPV4=n
CONFIG_NET_CONFIG_NEED_IPV6=y
# Network sockets
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y
CONFIG_NET_SOCKETS_POLL_MAX=4
# Enable TCP support
CONFIG_NET_TCP=y # Required for SOCKET STREAM
CONFIG_NET_UDP=y # Required for getting UTC time 
CONFIG_OPENTHREAD_TCP_ENABLE=n
#^from https://github.com/openthread/openthread/discussions/7784

CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=10
#^from https://devzone.nordicsemi.com/f/nordic-q-a/86632/openthread-and-mqtt-over-tls-is-single-program

#Socket settings
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
CONFIG_NET_SOCKETS_ENABLE_DTLS=n
CONFIG_POSIX_MAX_FDS=8
#^from https://devzone.nordicsemi.com/f/nordic-q-a/86933/azure-iot-hub-library-with-openthread/377915

CONFIG_NET_PKT_RX_COUNT=10
CONFIG_NET_PKT_TX_COUNT=10
#^from https://github.com/openthread/openthread/discussions/7784
CONFIG_NET_BUF_RX_COUNT=100
CONFIG_NET_BUF_TX_COUNT=100
#^from https://devzone.nordicsemi.com/f/nordic-q-a/86933/azure-iot-hub-library-with-openthread/377915

# Stack sizes configuration
CONFIG_NET_TX_STACK_SIZE=1200
CONFIG_NET_RX_STACK_SIZE=1500
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096

CONFIG_NET_MGMT_EVENT_INFO=y

# IP address options
CONFIG_NET_IF_UNICAST_IPV6_ADDR_COUNT=3
CONFIG_NET_IF_MCAST_IPV6_ADDR_COUNT=4
CONFIG_NET_MAX_CONTEXTS=10

[edmont]

Hi @TB4508 would you mind moving this question to the Nordic's Devzone? Since it's not OpenThread specific.

Also please take a look to this discussion in which another user eventually managed to make Nordic Connect SDK 1.9.1 work with Azure IoT Hub (see last comment): https://devzone.nordicsemi.com/f/nordic-q-a/90352/error--22-in-mqtt_connect---nrf52840dk-with-azure-iot-hub-using-openthread-and-tcp

[ghost]

Sure - I'm sorry I forgot to close this. I was the author on that DevZone post as well. It is now working well, but I wasn't sure where my issues were at the start.

Should I mark your comment as the answer or can this discussion be deleted entirely?

[edmont]

I'd say keeping it here wouldn't harm, in case others face similar issues.