STM32Cube_FW_F7 SSL client mbedTLS FATAL_ALERT

Question

I am trying to implement a SSL client into my IoT project. I have copied the SSL_Client example I found in STM32Cube_FW_F7_V1.15.0 into my project and was able to compile succesfully. However the SSL handshake fails with -0x7780 MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE. I attach the console debug output:

    . Seeding the random number generator... ok
    . Loading the CA root certificate ... ok (1 skipped)
    . Connecting to tcp/www.google.de/443... ok
    . Setting up the SSL/TLS structure... ok
    . Performing the SSL/TLS handshake...=> handshake
  client state: 0
  => flush output
  <= flush output
  client state: 1
  => flush output
  <= flush output
  => write client hello
  client hello, max version: [3:3]
  dumping 'client hello, random bytes' (32 bytes)
  0000:  88 d9 c4 b1 4f 82 ef a2 74 80 5c 6e 3f c4 29 ca  ....O...t.\n?.).
  0010:  a4 8d 61 2b f6 37 ec 93 39 cb 7d d0 39 5a 67 9b  ..a+.7..9.}.9Zg.
  client hello, session id len.: 0
  dumping 'client hello, session id' (0 bytes)
  client hello, add ciphersuite: c02b
  client hello, add ciphersuite: c031
  client hello, add ciphersuite: c02d
  client hello, add ciphersuite: 00a8
  client hello, got 4 ciphersuites (excluding SCSVs)
  adding EMPTY_RENEGOTIATION_INFO_SCSV
  client hello, compress len.: 1
  client hello, compress alg.: 0
  client hello, adding server name extension: mbed TLS Server 1
  client hello, adding signature_algorithms extension
  client hello, adding supported_elliptic_curves extension
  client hello, adding supported_point_formats extension
  client hello, adding encrypt_then_mac extension
  client hello, adding extended_master_secret extension
  client hello, total extension length: 62
  => write handshake message
  => write record
  output record: msgtype = 22, version = [3:3], msglen = 117
  dumping 'output record sent to network' (122 bytes)
  0000:  16 03 03 00 75 01 00 00 71 03 03 88 d9 c4 b1 4f  ....u...q......O
  0010:  82 ef a2 74 80 5c 6e 3f c4 29 ca a4 8d 61 2b f6  ...t.\n?.)...a+.
  0020:  37 ec 93 39 cb 7d d0 39 5a 67 9b 00 00 0a c0 2b  7..9.}.9Zg.....+
  0030:  c0 31 c0 2d 00 a8 00 ff 01 00 00 3e 00 00 00 16  .1.-.......>....
  0040:  00 14 00 00 11 6d 62 65 64 20 54 4c 53 20 53 65  .....mbed TLS Se
  0050:  72 76 65 72 20 31 00 0d 00 0a 00 08 04 03 04 01  rver 1..........
  0060:  03 03 03 01 00 0a 00 04 00 02 00 17 00 0b 00 02  ................
  0070:  01 00 00 16 00 00 00 17 00 00                    ..........
  => flush output
  message length: 122, out_left: 122
  ssl->f_send() returned 122 (-0xffffff86)
  <= flush output
  <= write record
  <= write handshake message
  <= write client hello
  client state: 2
  => flush output
  <= flush output
  => parse server hello
  => read record
  => fetch input
  in_left: 0, nb_want: 5
  in_left: 0, nb_want: 5
  ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
  <= fetch input
  dumping 'input record header' (5 bytes)
  0000:  15 03 03 00 02                                   .....
  input record: msgtype = 21, version = [3:3], msglen = 2
  => fetch input
  in_left: 5, nb_want: 7
  in_left: 5, nb_want: 7
  ssl->f_recv(_timeout)() returned 2 (-0xfffffffe)
  <= fetch input
  dumping 'input record from network' (7 bytes)
  0000:  15 03 03 00 02 02 28                             ......(
  got an alert message, type: [2:40]
  is a fatal alert message (msg 40)
  mbedtls_ssl_handle_message_type() returned -30592 (-0x7780)
  mbedtls_ssl_read_record() returned -30592 (-0x7780)
  <= handshake
   failed
    ! mbedtls_ssl_handshake returned -0x7780

I am thankfull for every hint in the right direction.

score 1 · Accepted Answer · answered May 07 '21 at 21:51

client hello, adding server name extension: mbed TLS Server 1

The client is using the SNI extension to indicate that it wants to talk to mbed TLS Server 1. The server on port 443 of www.google.de can respond as www.google.de, google.de and a bunch of other names that Google controls, but it does know about mbed TLS Server 1, so it sends a fatal alert indicating that it cannot complete the handshake.

You can use the sample client as is to talk to the sample server whose source code should be next to it. To contact another server, you need to change or remove the call to mbedtls_ssl_set_hostname.

STM32Cube_FW_F7 SSL client mbedTLS FATAL_ALERT

1 Answers1