During the parsing of the certificate, the public key is not being stored:

#if (!defined(WOLFSSL_NO_MALLOC) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
    defined(WOLFSSL_DYN_CERT)
    /* cert->publicKey not stored as copy if WOLFSSL_NO_MALLOC defined */
    if ((cert->keyOID == RSAk
    #ifdef WC_RSA_PSS
         || cert->keyOID == RSAPSSk
    #endif
         ) && cert->publicKey != NULL && cert->pubKeySize > 0) {
        ptr = (char*)XMALLOC(cert->pubKeySize, cert->heap,
                              DYNAMIC_TYPE_PUBLIC_KEY);
        if (ptr == NULL)
            return MEMORY_E;
        XMEMCPY(ptr, cert->publicKey, cert->pubKeySize);
        cert->publicKey = (byte *)ptr;
        cert->pubKeyStored = 1;
    }

#endif

So

cert->pubKeyStored

is not getting set to 1.  I was able to get past this by adding

-DWOLFSSL_DYN_CERT

to

CFLAGS

. That said, I later got an out of memory error:

wolfSSL Entering SendCertificateVerify
sent: certificate verify
connect state: FIRST_REPLY_THIRD
growing output buffer
wolfSSL Entering DtlsMsgPoolSave
wolfSSL Entering DtlsMsgNew
wolfSSL Leaving DtlsMsgPoolSave(), return 0
ERROR ran out of static memory
wolfSSL error occurred, error = -125
wolfSSL Entering wolfSSL_get_error
wolfSSL Leaving wolfSSL_get_error, return -125
err = -125, out of memory error

I'll need to ask my colleagues how to increase the memory pool size.

Please stay tuned.

Warm regards, Anthony

Hello likewise,
Can you please send a message to support@wolfssl.com noting your interest in this feature? 
Thanks and warm regards, Anthony

Hi Tony,
Excellent.  Instead of putting up a pull request, can you put up a bug report.  We have a preference for bug reports as accepting pull requests would require you submit a contributor agreement.
Warm regards, Anthony

Hi Tony,

I've modified your user_settings.h.  See the end of this message.  Then on my linux machine built with the following command:

./configure --enable-usersettings 

I then downloaded your root certificate and executed the example client like this:

./examples/client/client -A root.pem  -h a2jtk2rms8uea8-ats.iot.us-east-1.amazonaws.com -p 8883

And I got a successful TLS 1.3 connection. 

This tells me there might be some incompatibility with the way freeRTOS is being used or the way wolfMQTT is calling into wolfSSL. The most likely problem is a memory issue.  How much memory are you giving to this process?   Perhaps try increasing it?

Warm regards, Anthony

=============================================
#ifndef USER_SETTINGS_H
#define USER_SETTINGS_H

#define WOLFSSL_IGNORE_FILE_WARN

/*-- Cipher related definitions  -----------------------------------------------
*
*
*----------------------------------------------------------------------------*/
#define WOLFSSL_ALT_CERT_CHAINS

#define WOLFSSL_TLS13
#define HAVE_TLS_EXTENSIONS

#define HAVE_SUPPORTED_CURVES
#define HAVE_FFDHE_2048

#ifndef WOLFSSL_OPTIONS_IGNORE_SYS
    #undef  _POSIX_THREADS
    #define _POSIX_THREADS
#endif

#define HAVE_THREAD_LS
#define TFM_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT
#define WC_RSA_BLINDING

#define HAVE_AESGCM
#define HAVE_AESCCM
#define HAVE_AES_ECB
#define WOLFSSL_AES_COUNTER
#define WOLFSSL_AES_DIRECT

#define WOLFSSL_SHA512
#define WOLFSSL_SHA384
#define HAVE_HKDF

#define HAVE_ECC
#define TFM_ECC256
#define ECC_SHAMIR
#define WC_RSA_PSS
#define WOLFSSL_BASE64_ENCODE

#define WOLFSSL_KEY_GEN

#define HAVE_ECC_CDH
#define WC_RSA_NO_PADDING
#define WOLFSSL_VALIDATE_FFC_IMPORT
#define WOLFSSL_VALIDATE_ECC_IMPORT
#define HAVE_FFDHE_Q
#define WOLFSSL_NO_SHAKE256

#define WOLFSSL_CMAC
#define WOLFSSL_SHA224
#define WOLFSSL_SHA3
#define WOLFSSL_SHAKE256
#define HAVE_HASHDRBG

#define HAVE_SUPPORTED_CURVES
#define HAVE_EXTENDED_MASTER
#define HAVE_ENCRYPT_THEN_MAC
#define USE_FAST_MATH
#define WOLFSSL_X86_64_BUILD
#define WC_NO_ASYNC_THREADING
#define HAVE_DH_DEFAULT_PARAMS
#define HAVE___UINT128_T    1

#define NO_DSA
#define NO_HC128
#define NO_RABBIT
#define NO_RC4
#define NO_PSK
#define NO_MD4
#define NO_PWDBASED

/*-- Debugging options  ------------------------------------------------------
*
* "DEBUG_WOLFSSL" definition enables log to output into stdout.
* Note: wolfSSL_Debugging_ON() must be called just after wolfSSL_Init().
*----------------------------------------------------------------------------*/

#define DEBUG_WOLFSSL

#endif /* USER_SETTINGS_H */
========================================

Hi tonyjosi,

Note that reproducing and diagnosing this could take a bit of time. In the meantime, we quite often find that defining `WOLFSSL_ALT_CERT_CHAINS` often fixes this problem.  Can you please trying adding it your defines in your `user_settings.h` and then rebuilding everything?

Please let me know how it goes.

Warm regards, Anthony

Hi Sayeed,

My name is Anthony and I am a member of the wolfSSL team.  I'm not sure I understand your issue.  Can you give more details such as the compiler error message?

Warm regards, Anthony

Hi,
Have you tried using wolfSSH? It can be found at  https://github.com/wolfSSL/wolfssh or from our download page.
Warm regards, Anthony

Hi philipm,

Thank you so much for reaching out.  My name is Anthony and I am a member of the wolfSSL team.  Can you please send this request to support@wolfssl.com? This will allow us to better track your issue.

Warm regards, Anthony

I'm so glad I was able to provide helpful information.  Please feel free to use our technical support service at support@wolfssl.com should you prefer more private interactions. 

Warm regards, Anthony

Hi Dien,

I understand. Would you like to register your interest in CBC and CCM mode stream APIs as an official feature request?  It will only take a few minutes of your time.  If so, please send an email to support@wolfssl.com referencing this forum thread.

Warm regards, Anthony

Hi Ja1999,
Yes I suspect that would work.
Warm regards, Anthony