HTTPS OTAP from Let's Encrypt fails | Thales IoT Developer Community
September 24, 2021 - 9:31am, 854 views
Hello,
I've noticed this issue when moving a project to production setup.
I need to deploy a large number of ELS61T devices to the field, so I need to have OTAP working. We are using a private APN connected to a cloud server. A private DNS is setup on the cloud server, OTAP download over http from cloud server over private APN works.
While testing from an in-house server, OTAP downloads work just fine over HTTPS. In provided production setup, HTTPS OTAP download fails with "JAD Server not found" message in OTAP trace.
Our modules have Java secure **** enabled (signed app), but certificate verification is not enabled.
The only noticable difference between the to server systems we found is the certificates. In our system we use a classic wildcard certificate, issued to our domain. On the other hand, the cloud server uses a Let's Encrypt issued certificate. The software stack is identical, server supports TLS 1.2, SNI is required and working on the in-house system.
Digging into tehcnical differences, we noticed a different keysize between the two certificates: 2048 in-house vs. 4096 in the cloud. Might that be the cause?
I'd welcome any further insight as to where to look next...
Thank you,
Jure
Hello,
You could try to also test https connection to that server with AT commands or Java MIDlet. Maybe you'll see some more descriptive error.
Please check the firmware version with ATI1 command. In the recent version there were some changes in TLS libraries that should be taken into consideration. SNI support was introduced. Fast Math was introduced to speed up handling of public key operations. But as a drawback the longer keys may not work. So in case of RSA keys 4096 may not work while 2048 must work.
BR,
Bartłomiej
Hello,
indeed, the key size seems to be the cause of our problem. We modify the certificate refresh procedure for Let's Encrypt to ask for smaller key size (2048), and https otap started working.
We are still in test ****, but it's looking good!
Good to read that!