# TLS 1.2 mqtt:ssl handshake failed err:-0x7280

**URL:** <https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958>\
**Category:** SDK\
**Created:** [December 7, 2021, 4:48am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958 "2021-12-07T04:48:16Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruanjanc](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@ruanjanc](https://forum.amebaiot.com/u/ruanjanc)\
**Post date:** [December 7, 2021, 4:48am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/1 "2021-12-07T04:48:16Z")

</div>

Hi,

I’m facing issue with MQTT TLS Ver1.2 using, the ssl handshake failed err:-0x7280 on the beginning of handshake process.

SDK used is below.  
https://github.com/ambiot/amb1\_sdk

Modification point are:

1. inc/platform\_opts.h

```auto
/* For SSL/TLS */
#define CONFIG_USE_POLARSSL 1
#define CONFIG_USE_MBEDTLS 0

```

Change to

```auto
/* For SSL/TLS */
#define CONFIG_USE_POLARSSL 0
#define CONFIG_USE_MBEDTLS 1

```

1. component\common\network\ssl\mbedtls-2.4.0\include\mbedtls\config\_rsa.h  
` #define MBEDTLS_SSL_MAX_CONTENT_LEN 4096`  
change to  
`#define MBEDTLS_SSL_MAX_CONTENT_LEN 16384`

2. component\common\application\mqtt\MQTTClient\MQTTFreertos.c

```auto
  int NetworkConnect(Network* n, char* addr, int port)
  {
    .
    .
    if((mbedtls_ssl_config_defaults(n->conf,
				MBEDTLS_SSL_IS_CLIENT,
				MBEDTLS_SSL_TRANSPORT_STREAM,
				MBEDTLS_SSL_PRESET_DEFAULT)) != 0) { // <--TLS 1.0
			mqtt_printf(MQTT_DEBUG, "ssl config defaults failed!");
			goto err;
     }
    .
    .
  }

```

Change to

```auto
 int NetworkConnect(Network* n, char* addr, int port)
  {
    .
    .
    if((mbedtls_ssl_config_defaults(n->conf,
				MBEDTLS_SSL_IS_CLIENT,
				MBEDTLS_SSL_TRANSPORT_STREAM,
				MBEDTLS_SSL_PRESET_SUITEB)) != 0) { // <-- TLS 1.2
			mqtt_printf(MQTT_DEBUG, "ssl config defaults failed!");
			goto err;
     }
    .
    .
  }

```

Below is the ssl handshake log.

```auto
[Sat Dec 04 22:12:24.182 2021] [7287]mqtt:root_crt parse done
[Sat Dec 04 22:12:24.198 2021] ssl_tls.c:6344: |2| => handshake
[Sat Dec 04 22:12:24.198 2021] ssl_cli.c:3279: |2| client state: 0
[Sat Dec 04 22:12:24.214 2021] ssl_tls.c:2420: |2| => flush output
[Sat Dec 04 22:12:24.215 2021] ssl_tls.c:2432: |2| <= flush output
[Sat Dec 04 22:12:24.247 2021] ssl_cli.c:3279: |2| client state: 1
[Sat Dec 04 22:12:24.248 2021] ssl_tls.c:2420: |2| => flush output
[Sat Dec 04 22:12:24.248 2021] ssl_tls.c:2432: |2| <= flush output
[Sat Dec 04 22:12:24.264 2021] ssl_cli.c:0717: |2| => write client hello
[Sat Dec 04 22:12:24.280 2021] ssl_cli.c:0755: |3| client hello, max version: [3:3]
[Sat Dec 04 22:12:24.281 2021] ssl_cli.c:0764: |3| dumping 'client hello, random bytes' (32 bytes)
[Sat Dec 04 22:12:24.309 2021] ssl_cli.c:0764: |3| 0000: 96 42 17 1b 4c 8b 10 08 85 e6 93 0b 68 02 10 0a .B..L.......h...
[Sat Dec 04 22:12:24.326 2021] ssl_cli.c:0764: |3| 0010: 0c f4 91 0b fa 46 10 0b 48 bd 90 0b b3 64 90 0b .....F..H....d..
[Sat Dec 04 22:12:24.357 2021] ssl_cli.c:0817: |3| client hello, session id len.: 0
[Sat Dec 04 22:12:24.373 2021] ssl_cli.c:0818: |3| dumping 'client hello, session id' (0 bytes)
[Sat Dec 04 22:12:24.389 2021] ssl_cli.c:0918: |3| client hello, got 1 ciphersuites
[Sat Dec 04 22:12:24.405 2021] ssl_cli.c:0949: |3| client hello, compress len.: 1
[Sat Dec 04 22:12:24.421 2021] ssl_cli.c:0951: |3| client hello, compress alg.: 0
[Sat Dec 04 22:12:24.437 2021] ssl_cli.c:0178: |3| client hello, adding signature_algorithms extension
[Sat Dec 04 22:12:24.453 2021] ssl_cli.c:0508: |3| client hello, adding encrypt_then_mac extension
[Sat Dec 04 22:12:24.469 2021] ssl_cli.c:0542: |3| client hello, adding extended_master_secret extension
[Sat Dec 04 22:12:24.485 2021] ssl_cli.c:0575: |3| client hello, adding session ticket extension
[Sat Dec 04 22:12:24.501 2021] ssl_cli.c:1023: |3| client hello, total extension length: 22
[Sat Dec 04 22:12:24.517 2021] ssl_tls.c:2705: |2| => write record
[Sat Dec 04 22:12:24.533 2021] ssl_tls.c:2842: |3| output record: msgtype = 22, version = [3:3], msglen = 69
[Sat Dec 04 22:12:24.549 2021] ssl_tls.c:2845: |4| dumping 'output record sent to network' (74 bytes)
[Sat Dec 04 22:12:24.565 2021] ssl_tls.c:2845: |4| 0000: 16 03 03 00 45 01 00 00 41 03 03 96 42 17 1b 4c ....E...A...B..L
[Sat Dec 04 22:12:24.600 2021] ssl_tls.c:2845: |4| 0010: 8b 10 08 85 e6 93 0b 68 02 10 0a 0c f4 91 0b fa .......h........
[Sat Dec 04 22:12:24.647 2021] ssl_tls.c:2845: |4| 0020: 46 10 0b 48 bd 90 0b b3 64 90 0b 00 00 02 00 ff F..H....d.......
[Sat Dec 04 22:12:24.649 2021] ssl_tls.c:2845: |4| 0030: 01 00 00 16 00 0d 00 06 00 04 04 01 05 01 00 16 ................
[Sat Dec 04 22:12:24.679 2021] ssl_tls.c:2845: |4| 0040: 00 00 00 17 00 00 00 23 00 00 .......#..
[Sat Dec 04 22:12:24.692 2021] ssl_tls.c:2420: |2| => flush output
[Sat Dec 04 22:12:24.708 2021] ssl_tls.c:2439: |2| message length: 74, out_left: 74
[Sat Dec 04 22:12:24.724 2021] ssl_tls.c:2445: |2| ssl->f_send() returned 74 (-0xffffffb6)
[Sat Dec 04 22:12:24.740 2021] ssl_tls.c:2464: |2| <= flush output
[Sat Dec 04 22:12:24.741 2021] ssl_tls.c:2854: |2| <= write record
[Sat Dec 04 22:12:24.756 2021] ssl_cli.c:1049: |2| <= write client hello
[Sat Dec 04 22:12:24.771 2021] ssl_cli.c:3279: |2| client state: 2
[Sat Dec 04 22:12:24.772 2021] ssl_tls.c:2420: |2| => flush output
[Sat Dec 04 22:12:24.787 2021] ssl_tls.c:2432: |2| <= flush output
[Sat Dec 04 22:12:24.803 2021] ssl_cli.c:1410: |2| => parse server hello
[Sat Dec 04 22:12:24.803 2021] ssl_tls.c:3732: |2| => read record
[Sat Dec 04 22:12:24.819 2021] ssl_tls.c:2212: |2| => fetch input
[Sat Dec 04 22:12:24.835 2021] ssl_tls.c:2370: |2| in_left: 0, nb_want: 5
[Sat Dec 04 22:12:24.917 2021] ssl_tls.c:2394: |2| in_left: 0, nb_want: 5
[Sat Dec 04 22:12:24.918 2021] ssl_tls.c:2395: |2| ssl->f_recv(_timeout)() returned 0 (-0x0000)
[Sat Dec 04 22:12:24.938 2021] ssl_tls.c:3793: |1| mbedtls_ssl_fetch_input() returned -29312 (-0x7280)
[Sat Dec 04 22:12:24.964 2021] ssl_tls.c:3738: |1| mbedtls_ssl_read_record_layer() returned -29312 (-0x7280)
[Sat Dec 04 22:12:24.981 2021] ssl_cli.c:1416: |1| mbedtls_ssl_read_record() returned -29312 (-0x7280)
[Sat Dec 04 22:12:25.012 2021] ssl_tls.c:6354: |2| <= handshake
[Sat Dec 04 22:12:25.012 2021] 
[Sat Dec 04 22:12:25.012 2021] [8121]mqtt:ssl handshake failed err:-0x7280
[Sat Dec 04 22:12:25.042 2021] ssl_tls.c:7064: |2| => free
[Sat Dec 04 22:12:25.090 2021] ssl_tls.c:7129: |2| <= free

```

Seem the problem is occur on the beginning of the handshake process.

Any suggestion ?

Regards,

---

<div class="post-metadata">

**Author:** ![wyy](https://avatars.discourse-cdn.com/v4/letter/w/bc8723/32.png) [@wyy](https://forum.amebaiot.com/u/wyy)\
**Post date:** [December 7, 2021, 9:21am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/2 "2021-12-07T09:21:24Z")

</div>

-0x7280 corresponds to MBEDTLS\_ERR\_SSL\_CONN\_EOF -0x7280 /\*\*\< The connection indicated an EOF. \*/

my guess would be that the enabled ciphersuites and those supported on the server are different

---

<div class="post-metadata">

**Author:** ![ruanjanc](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@ruanjanc](https://forum.amebaiot.com/u/ruanjanc)\
**Post date:** [December 7, 2021, 9:31am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/3 "2021-12-07T09:31:20Z")

</div>

@wyy  
Thanks for your quick reply.

> my guess would be that the enabled ciphersuites and those supported on the server are different

That was my guess also.

Below are results from https://www.ssllabs.com/ssltest/ for the ciphersuites test of TLS 1.2.

> # TLS 1.2 (suites in server-preferred order)
> 
> TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256 ( `0xc027` ) ECDH secp256r1 (eq. 3072 bits RSA) FS **WEAK** 128  
> TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 ( `0x9f` ) DH 2048 bits FS 256  
> TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 ( `0x9e` ) DH 2048 bits FS 128  
> TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384 ( `0x9d` ) **WEAK** 256  
> TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 ( `0x9c` ) **WEAK** 128  
> TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256 ( `0x3d` ) **WEAK** 256  
> TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256 ( `0x3c` ) **WEAK** 128  
> TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA ( `0xc014` ) ECDH secp384r1 (eq. 7680 bits RSA) FS **WEAK** 256  
> TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA ( `0xc013` ) ECDH secp256r1 (eq. 3072 bits RSA) FS **WEAK** 128  
> TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA ( `0x35` ) **WEAK** 256  
> TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA ( `0x2f` ) **WEAK** 128  
> TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA ( `0xa` ) **WEAK** 112

I try to enable all above list inside config\_rsa.h, but still facing the same issue.

Regards,

---

<div class="post-metadata">

**Author:** ![wyy](https://avatars.discourse-cdn.com/v4/letter/w/bc8723/32.png) [@wyy](https://forum.amebaiot.com/u/wyy)\
**Post date:** [December 7, 2021, 10:49am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/4 "2021-12-07T10:49:10Z")

</div>

You might want to try configuring mbedTLS to the same [settings](https://github.com/ambiot/ambd_arduino/blob/master/Arduino_package/hardware/system/component/common/network/ssl/mbedtls-2.4.0/include/mbedtls/config_arduino.h) used for the RTL8722DM, and see if those would work.

---

<div class="post-metadata">

**Author:** ![ruanjanc](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@ruanjanc](https://forum.amebaiot.com/u/ruanjanc)\
**Post date:** [December 8, 2021, 1:34am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/5 "2021-12-08T01:34:07Z")

</div>

@wyy  
Thank you for your support.  
Still cannot success to handshake got the same error code. Now I contact to server side support, maybe if we can get server side log we might know the reason.

Anyway, one thing I want to confirm with you.  
Is there any limitation to use TLS Ver1.2 on ameba1 ?

Regards,

---

<div class="post-metadata">

**Author:** ![wyy](https://avatars.discourse-cdn.com/v4/letter/w/bc8723/32.png) [@wyy](https://forum.amebaiot.com/u/wyy)\
**Post date:** [December 8, 2021, 2:39am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/6 "2021-12-08T02:39:02Z")

</div>

@ruanjanc

I have gotten the ssl handshake working with [google.com](http://google.com), but that is with `MBEDTLS_SSL_PRESET_DEFAULT` instead of `MBEDTLS_SSL_PRESET_SUITEB`.

Is there a specific reason to be using SUITEB?  
also, can you provide the server you are testing with?

---

<div class="post-metadata">

**Author:** ![ruanjanc](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@ruanjanc](https://forum.amebaiot.com/u/ruanjanc)\
**Post date:** [December 8, 2021, 3:21am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/7 "2021-12-08T03:21:50Z")

</div>

@wyy  
`I have gotten the ssl handshake working with [google.com](http://google.com/), but that is with `MBEDTLS\_SSL\_PRESET\_DEFAULT`instead of`MBEDTLS\_SSL\_PRESET\_SUITEB` .`  
Is MBEDTLS\_SSL\_PRESET\_DEFAULT not for TLS Ver1.0 ?

`Is there a specific reason to be using SUITEB?`  
This is because of server side is not support for TLS ver1.0, it support for TLS ver1.2.

Below is from ssl\_tls.c

```auto
int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
                                 int endpoint, int transport, int preset )
{
.
.
    /*
     * Preset-specific defaults
     */
    switch( preset )
    {
        /*
         * NSA Suite B
         */
        case MBEDTLS_SSL_PRESET_SUITEB:
            conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
            conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
            conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
            conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;

            conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
            conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
            conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
            conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
                                   ssl_preset_suiteb_ciphersuites;

.
            break;

        /*
         * Default
         */
        default:
            conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
            conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_1; /* TLS 1.0 */
            conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
            conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
.
.
}

```

From above code if we need TLS ver1.2 we have to use MBEDTLS\_SSL\_PRESET\_SUITEB, Is my understand correct ?

` can you provide the server you are testing with?`  
I test with hivemq cloud mqtt broker.  
https://www.hivemq.com/mqtt-cloud-broker/  
I have free account, if you are interest to test I can share my account name via PM.

Regards,

---

<div class="post-metadata">

**Author:** ![ruanjanc](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@ruanjanc](https://forum.amebaiot.com/u/ruanjanc)\
**Post date:** [December 8, 2021, 4:56am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/8 "2021-12-08T04:56:39Z")

</div>

@wyy  
Probably it is my misunderstood regarding to MBEDTLS\_SSL\_PRESET\_SUITEB.  
Is MBEDTLS\_SSL\_PRESET\_SUITEB not mean force to use TLS Ver1.2 right ?

Seem that the beginning of handshake process client side inform tls min/max version supported to server side.

So, if we used MBEDTLS\_SSL\_PRESET\_DEFAULT

```auto
        default:
            conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
            conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_1; /* TLS 1.0 */
            conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
            conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;

```

client side tls min version would be 1.0 and max version would be 1.2.

I will switch to use MBEDTLS\_SSL\_PRESET\_DEFAULT.

Regards,

---

<div class="post-metadata">

**Author:** ![wyy](https://avatars.discourse-cdn.com/v4/letter/w/bc8723/32.png) [@wyy](https://forum.amebaiot.com/u/wyy)\
**Post date:** [December 8, 2021, 5:20am UTC](https://forum.amebaiot.com/t/tls-1-2-mqtt-ssl-handshake-failed-err-0x7280/958/9 "2021-12-08T05:20:17Z")

</div>

@ruanjanc

I am not too familiar with the use of SUITEB, but it seems to impose additional requirements on top of TLS1.2, such as limitations on the ciphersuites hashes and encryption curves that can be used.

In any case, I could connect to hivemq with `MBEDTLS_SSL_PRESET_DEFAULT`.