Hi there,

I've been working on a project that needs an MQTT library update. The library uses wolfSSL v3.10.2 to run TLSv1.2.

More details:

• Building with IAR

• Currently using Wolf's sample IAR-EWARM project with a custom user_settings.h

• WolfSSL port: https://github.com/xively/xively-client … _wolfssl.c

Same code seems to work fine on other platforms and versions:

• The previous version of the project also used WolfSSL, with no connection problems.

• I am running the same version of the MQTT library and WolfSSL, the same RTOS, network stack and CA cert store on a different hardware platform. No connection problems.

• I have tried many different configurations: Almost exactly the same as the previous version, almost exactly the same as other platforms, exactly the same as the WolfSSL IDE sample projects, combinations of them all, fully custom... None of that fixes the issue.

More debugging:

• I've used wireshark to obtain the cert chain provided by the server. It starts at this intermediary:

      [-] Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA[/-]
      [-] Subject: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2[/-]
    Then I printed the device's CA cert buffer after CyaSSL_CTX_load_verify_buffer returns SSL_SUCCESS. It contains 4 roots; this is one of them:

      [-] Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA[/-]
      [-] Subject: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA[/-]
    So I think the certificate store is OK. To verify that 100%, I copy/pasted the printed buffer into a file, ran WolfSSL's client example with that store, and got a successful TLS connection

• I disabled certificate validation, but the connection still failed. This time, with a PEER_KEY_ERROR (-342)

• SNI and OCSP are enabled on the device, as required by the server

• Cipher suites seem compatible. The wireshark'd Client Hello includes a list of 10 suites, and the Server Hello selected the client's first option (0xc027: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)

• The validation process fails after the client has received the server’s certificate chain, the second time WolfSSL calls GetCA() in asn.c. The first certificate is parsed correctly, but the second one returns NULL, which makes ParseCertRelative() return ASN_NO_SIGNER_E.

Here's an overview of the failed TLS handshake in wireshark:

My WolfSSL IAR project is configured for the correct platform. The project itself only defines WOLFSSL_USER_SETTINGS, which is also defined in the IAR project for the MQTT library. Both of them include the same header:

/* From WolfSSL's original IAR sample */
#define NO_MAIN_DRIVER
#define BENCH_EMBEDDED
#define SINGLE_THREADED
#define NO_FILESYSTEM
#define NO_WRITEV
#define WOLFSSL_USER_IO
#define NO_DEV_RANDOM
#define WOLFSSL_USER_CURRTIME
#define SIZEOF_LONG_LONG 8

/* Libxively requirements */
#define TIME_OVERRIDES
#define HAVE_TLS_EXTENSIONS
#define HAVE_CERTIFICATE_STATUS_REQUEST
#define HAVE_OCSP
#define HAVE_SNI
#define CUSTOM_RAND_GENERATE_SEED xi_bsp_rng_generate_wolfssl_seed

/* Flash and RAM optimizations */
#define SMALL_SESSION_CACHE
/* To be defined once I have a working connection:
NO_DES
NO_DES3
NO_DSA
NO_ERROR_STRINGS
NO_MD4
NO_PSK
NO_PWDBASED
NO_RC4
NO_RABBIT
NO_HC128
NO_SHA512
*/

Are you familiar with this issue? Can you see any problems with my build configuration? Any idea on where I should keep debugging?
Any suggestions would be greatly appreciated.

Thanks!