Wolfssl/wolfmqtt to connect to hive cloud

I am trying to use non blocking wolfssl/wolfmqtt to connect to hive cloud (free at the moment and paid later on if we manage to actualy use it) with url
483a5ca0b4ad42a2be466e77a64b59d5.s2.eu.hivemq.cloud

following the advice here (wolfMQTT Client Supports HiveMQ Cloud - wolfSSL) i have enabled SNI and build it with “–enable-altcertchains” but when i run

openssl s_client -connect 483a5ca0b4ad42a2be466e77a64b59d5.s2.eu.hivemq.cloud:8883 -showcerts < /dev/null 2> /dev/null | sed -n ‘/BEGIN/,/END/p’ > server.pem

the last certificate i get is
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
i:O = Digital Signature Trust Co., CN = DST Root CA X3

Is the “DST Root CA X3” the one that expired on Sept 2021?

following this Need certificate to achieve SSL connexion - #2 by Daria_H and this WolfSSL seems to be unable to use Let's encrypt certificates after DST Root CA X3 Expiration · Issue #4443 · wolfSSL/wolfssl · GitHub I added the provided isrgrootx1.pem as a CA but i still get errors when trying to connect. i can connect to mozilla 8883 with no problem.

Any help would be apriaceted

This is the debug output and the error codes from wolfssl
WANT_READ = -323, /* want read, call again /
ZERO_RETURN = -343, /
peer sent close notify */
– debug output
MQTT Client: QoS 1, Use TLS 1
MQTT Net Init: Success (0)
MQTT Init: Success (0)
NetConnect: Host 483a5ca0b4ad42a2be466e77a64b59d5.s2.eu.hivemq.cloud, Port 8883, Timeout 5000 ms, Use TLS 1
I (20919) wolfssl: wolfSSL Entering wolfSSL_Init
I (20919) wolfssl: wolfSSL Entering wolfCrypt_Init
I (20919) wolfssl: wolfSSL Entering SSLv23_client_method_ex
I (20919) wolfssl: wolfSSL Entering wolfSSL_CTX_new_ex
I (20929) wolfssl: wolfSSL Entering wolfSSL_CertManagerNew
I (20929) wolfssl: wolfSSL Leaving WOLFSSL_CTX_new, return 0
I (20939) wolfssl: wolfSSL Entering wolfSSL_CTX_set_verify
I (21149) wolfssl: wolfSSL Entering wolfSSL_CTX_load_verify_buffer_ex
I (21149) wolfssl: Processing CA PEM file
I (21149) wolfssl: wolfSSL Entering PemToDer
I (21149) wolfssl: Adding a CA
I (21159) wolfssl: wolfSSL Entering GetExplicitVersion
I (21159) wolfssl: wolfSSL Entering wc_GetSerialNumber
I (21169) wolfssl: Got Cert Header
I (21169) wolfssl: wolfSSL Entering GetAlgoId
I (21179) wolfssl: wolfSSL Entering GetObjectId()
I (21179) wolfssl: Got Algo ID
I (21189) wolfssl: Getting Cert Name
I (21189) wolfssl: Getting Cert Name
I (21189) wolfssl: Getting Cert Name
I (21199) wolfssl: Getting Cert Name
I (21199) wolfssl: Got Subject Name
I (21209) wolfssl: wolfSSL Entering GetAlgoId
I (21209) wolfssl: wolfSSL Entering GetObjectId()
I (21219) wolfssl: Got Key
I (21219) wolfssl: Parsed Past Key
I (21219) wolfssl: wolfSSL Entering DecodeCertExtensions
I (21229) wolfssl: wolfSSL Entering GetObjectId()
I (21239) wolfssl: wolfSSL Entering DecodeKeyUsage
I (21239) wolfssl: wolfSSL Entering GetObjectId()
I (21249) wolfssl: wolfSSL Entering DecodeBasicCaConstraint
I (21249) wolfssl: wolfSSL Entering GetObjectId()
I (21259) wolfssl: wolfSSL Entering DecodeSubjKeyId
I (21259) wolfssl: wolfSSL Entering GetAlgoId
I (21269) wolfssl: wolfSSL Entering GetObjectId()
I (21269) wolfssl: Parsed new CA
I (21279) wolfssl: Freeing Parsed CA
I (21279) wolfssl: Freeing der CA
I (21289) wolfssl: OK Freeing der CA
I (21289) wolfssl: wolfSSL Leaving AddCA, return 0
I (21299) wolfssl: Processed a CA
I (21299) wolfssl: Processed at least one valid CA. Other stuff OK
I (21309) wolfssl: wolfSSL Leaving wolfSSL_CTX_load_verify_buffer_ex, return 1
MQTT TLS Setup (1)
I (21519) wolfssl: wolfSSL Entering SSL_new
I (21519) wolfssl: wolfSSL Leaving SSL_new, return 0
I (21519) wolfssl: wolfSSL Entering wolfSSL_SetCertCbCtx
I (21519) wolfssl: wolfSSL Entering SSL_connect()
I (21529) wolfssl: wolfSSL Entering SendTls13ClientHello
I (21529) wolfssl: Adding signature algorithms extension
I (21539) wolfssl: Adding supported versions extension
I (21549) wolfssl: wolfSSL Entering EccMakeKey
I (21979) wolfssl: wolfSSL Leaving EccMakeKey, return 0
I (21979) wolfssl: growing output buffer
I (21979) wolfssl: Key Share extension to write
I (21989) wolfssl: Supported Versions extension to write
I (21989) wolfssl: Signature Algorithms extension to write
I (21999) wolfssl: Point Formats extension to write
I (21999) wolfssl: Supported Groups extension to write
I (22009) wolf_hw_sha: someone used. hw is locked…
I (22019) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22019) wolf_hw_sha: someone used. hw is locked…
I (22029) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22039) wolfssl: Shrinking output buffer
I (22039) wolfssl: wolfSSL Leaving SendTls13ClientHello, return 0
I (22049) wolfssl: connect state: CLIENT_HELLO_SENT
I (22059) wolfssl: wolfSSL error occurred, error = -323
I (22059) wolfssl: wolfSSL Entering SSL_get_error
I (22069) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (22099) wolfssl: wolfSSL Entering wolfSSL_SetCertCbCtx
I (22099) wolfssl: wolfSSL Entering SSL_connect()
I (22099) wolfssl: wolfSSL error occurred, error = -323
I (22099) wolfssl: wolfSSL Entering SSL_get_error
I (22109) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (22139) wolfssl: wolfSSL Entering wolfSSL_SetCertCbCtx
I (22139) wolfssl: wolfSSL Entering SSL_connect()
I (22139) wolfssl: wolfSSL error occurred, error = -323
I (22139) wolfssl: wolfSSL Entering SSL_get_error
I (22149) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (22179) wolfssl: wolfSSL Entering wolfSSL_SetCertCbCtx
I (22179) wolfssl: wolfSSL Entering SSL_connect()
I (22179) wolfssl: growing input buffer
I (22179) wolfssl: received record layer msg
I (22189) wolfssl: got HANDSHAKE
I (22189) wolfssl: wolfSSL Entering DoTls13HandShakeMsg()
I (22199) wolfssl: wolfSSL Entering DoTls13HandShakeMsgType
I (22199) wolfssl: processing server hello
I (22209) wolfssl: wolfSSL Entering DoTls13ServerHello
I (22209) wolfssl: Point Formats extension received
I (22219) wolfssl: wolfSSL Entering VerifyClientSuite
I (22219) wolfssl: wolfSSL Leaving DoTls13ServerHello, return 0
I (22229) wolfssl: Shrinking input buffer
I (22229) wolfssl: wolfSSL Leaving DoTls13HandShakeMsgType(), return 0
I (22239) wolfssl: wolfSSL Leaving DoTls13HandShakeMsg(), return 0
I (22249) wolfssl: growing input buffer
I (22259) wolfssl: received record layer msg
I (22259) wolfssl: got HANDSHAKE
I (22259) wolfssl: wolfSSL Entering DoHandShakeMsg()
I (22269) wolfssl: wolfSSL Entering DoHandShakeMsgType
I (22279) wolfssl: processing certificate
I (22279) wolfssl: wolfSSL Entering DoCertificate
I (22279) wolfssl: wolfSSL Entering ProcessPeerCerts
I (22289) wolfssl: Loading peer’s cert chain
I (22289) wolfssl: Put another cert into chain
I (22299) wolfssl: Put another cert into chain
I (22299) wolfssl: Put another cert into chain
I (22309) wolfssl: wolfSSL Entering GetExplicitVersion
I (22319) wolfssl: wolfSSL Entering wc_GetSerialNumber
I (22319) wolfssl: Got Cert Header
I (22329) wolfssl: wolfSSL Entering GetAlgoId
I (22329) wolfssl: wolfSSL Entering GetObjectId()
I (22339) wolfssl: Got Algo ID
I (22339) wolfssl: Getting Cert Name
I (22339) wolfssl: Getting Cert Name
I (22349) wolf_hw_sha: someone used. hw is locked…
I (22349) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22359) wolfssl: Getting Cert Name
I (22369) wolfssl: Getting Cert Name
I (22369) wolf_hw_sha: someone used. hw is locked…
I (22379) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22389) wolfssl: Got Subject Name
I (22389) wolfssl: wolfSSL Entering GetAlgoId
I (22389) wolfssl: wolfSSL Entering GetObjectId()
I (22399) wolfssl: Got Key
I (22399) wolfssl: Parsed Past Key
I (22409) wolfssl: wolfSSL Entering DecodeCertExtensions
I (22409) wolfssl: wolfSSL Entering GetObjectId()
I (22419) wolfssl: wolfSSL Entering DecodeBasicCaConstraint
I (22419) wolfssl: wolfSSL Entering GetObjectId()
I (22429) wolfssl: wolfSSL Entering DecodeKeyUsage
I (22439) wolfssl: wolfSSL Entering GetObjectId()
I (22439) wolfssl: wolfSSL Entering DecodeAuthInfo
I (22449) wolfssl: wolfSSL Entering GetObjectId()
I (22449) wolfssl: wolfSSL Entering GetObjectId()
I (22459) wolfssl: wolfSSL Entering DecodeAuthKeyId
I (22459) wolfssl: wolfSSL Entering GetObjectId()
I (22469) wolfssl: Certificate Policy extension not supported yet.
I (22479) wolfssl: wolfSSL Entering GetObjectId()
I (22479) wolfssl: wolfSSL Entering DecodeCrlDist
I (22489) wolfssl: wolfSSL Entering GetObjectId()
I (22489) wolfssl: wolfSSL Entering DecodeSubjKeyId
I (22499) wolfssl: wolfSSL Entering GetAlgoId
I (22499) wolfssl: wolfSSL Entering GetObjectId()
I (22509) wolfssl: No CA signer to verify with
I (22509) wolfssl: Failed to verify CA from chain
I (22519) wolfssl: Trying alternate cert chain
I (22519) wolfssl: wolfSSL Entering GetExplicitVersion
I (22529) wolfssl: wolfSSL Entering wc_GetSerialNumber
I (22529) wolfssl: Got Cert Header
I (22539) wolfssl: wolfSSL Entering GetAlgoId
I (22539) wolfssl: wolfSSL Entering GetObjectId()
I (22549) wolfssl: Got Algo ID
I (22549) wolfssl: Getting Cert Name
I (22559) wolfssl: Getting Cert Name
I (22559) wolf_hw_sha: someone used. hw is locked…
I (22569) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22579) wolfssl: Getting Cert Name
I (22579) wolfssl: Getting Cert Name
I (22579) wolf_hw_sha: someone used. hw is locked…
I (22589) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22599) wolfssl: Got Subject Name
I (22599) wolfssl: wolfSSL Entering GetAlgoId
I (22609) wolfssl: wolfSSL Entering GetObjectId()
I (22609) wolfssl: Got Key
I (22619) wolfssl: Parsed Past Key
I (22619) wolfssl: wolfSSL Entering DecodeCertExtensions
I (22629) wolfssl: wolfSSL Entering GetObjectId()
I (22629) wolfssl: wolfSSL Entering DecodeKeyUsage
I (22639) wolfssl: wolfSSL Entering GetObjectId()
I (22639) wolfssl: wolfSSL Entering DecodeExtKeyUsage
I (22649) wolfssl: wolfSSL Entering GetObjectId()
I (22649) wolfssl: wolfSSL Entering GetObjectId()
I (22659) wolfssl: wolfSSL Entering GetObjectId()
I (22659) wolfssl: wolfSSL Entering DecodeBasicCaConstraint
I (22669) wolfssl: wolfSSL Entering GetObjectId()
I (22679) wolfssl: wolfSSL Entering DecodeSubjKeyId
I (22679) wolfssl: wolfSSL Entering GetObjectId()
I (22699) wolfssl: wolfSSL Entering DecodeAuthKeyId
I (22699) wolfssl: wolfSSL Entering GetObjectId()
I (22709) wolfssl: wolfSSL Entering DecodeAuthInfo
I (22719) wolfssl: wolfSSL Entering GetObjectId()
I (22719) wolfssl: wolfSSL Entering GetObjectId()
I (22729) wolfssl: wolfSSL Entering DecodeCrlDist
I (22729) wolfssl: wolfSSL Entering GetObjectId()
I (22739) wolfssl: Certificate Policy extension not supported yet.
I (22739) wolfssl: wolfSSL Entering GetAlgoId
I (22749) wolfssl: wolfSSL Entering GetObjectId()
I (22749) wolfssl: CA found
I (22759) wolfssl: CA boolean set
I (22759) wolfssl: Extension Key Usage Set
I (22769) wolfssl: maxPathLen status: set to pathLength
I (22769) wolfssl: wolfSSL Entering ConfirmSignature
I (22779) wolf_hw_sha: someone used. hw is locked…
I (22779) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22789) wolfssl: RSA_FUNCTION MP_EXPTMOD_E: memory/config problem
I (22799) wolfssl: wolfSSL Leaving ConfirmSignature, return -155
I (22809) wolfssl: Confirm signature failed
I (22809) wolfssl: Failed to verify CA from chain
I (22819) wolfssl: wolfSSL Entering ERR_error_string
++++ MQTT TLS Verify Callback for : PreVerify 0, Error -155 (ASN sig error, confirm failure)
Subject’s domain name is R3 out of 3 certs
Allowing cert anyways
I (22839) wolfssl: Verify callback overriding error!
I (22839) wolfssl: Verifying Peer’s cert
I (22849) wolfssl: wolfSSL Entering GetExplicitVersion
I (22849) wolfssl: wolfSSL Entering wc_GetSerialNumber
I (22859) wolfssl: Got Cert Header
I (22859) wolfssl: wolfSSL Entering GetAlgoId
I (22869) wolfssl: wolfSSL Entering GetObjectId()
I (22869) wolfssl: Got Algo ID
I (22879) wolfssl: Getting Cert Name
I (22879) wolfssl: Getting Cert Name
I (22889) wolf_hw_sha: someone used. hw is locked…
I (22889) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22899) wolfssl: Getting Cert Name
I (22899) wolfssl: Getting Cert Name
I (22909) wolf_hw_sha: someone used. hw is locked…
I (22909) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (22919) wolfssl: Got Subject Name
I (22929) wolfssl: wolfSSL Entering GetAlgoId
I (22929) wolfssl: wolfSSL Entering GetObjectId()
I (22939) wolfssl: Got Key
I (22939) wolfssl: Parsed Past Key
I (22939) wolfssl: wolfSSL Entering DecodeCertExtensions
I (22949) wolfssl: wolfSSL Entering GetObjectId()
I (22959) wolfssl: wolfSSL Entering DecodeKeyUsage
I (22959) wolfssl: wolfSSL Entering GetObjectId()
I (22979) wolfssl: wolfSSL Entering DecodeExtKeyUsage
I (22979) wolfssl: wolfSSL Entering GetObjectId()
I (22989) wolfssl: wolfSSL Entering GetObjectId()
I (22989) wolfssl: wolfSSL Entering GetObjectId()
I (22999) wolfssl: wolfSSL Entering DecodeBasicCaConstraint
I (23009) wolfssl: wolfSSL Entering GetObjectId()
I (23009) wolfssl: wolfSSL Entering DecodeSubjKeyId
I (23019) wolfssl: wolfSSL Entering GetObjectId()
I (23019) wolfssl: wolfSSL Entering DecodeAuthKeyId
I (23029) wolfssl: wolfSSL Entering GetObjectId()
I (23029) wolfssl: wolfSSL Entering DecodeAuthInfo
I (23039) wolfssl: wolfSSL Entering GetObjectId()
I (23039) wolfssl: wolfSSL Entering GetObjectId()
I (23049) wolfssl: wolfSSL Entering DecodeAltNames
I (23049) wolfssl: wolfSSL Entering GetObjectId()
I (23059) wolfssl: Certificate Policy extension not supported yet.
I (23069) wolfssl: wolfSSL Entering GetObjectId()
I (23069) wolfssl: wolfSSL Entering GetAlgoId
I (23079) wolfssl: wolfSSL Entering GetObjectId()
I (23079) wolfssl: No CA signer to verify with
I (23089) wolfssl: Failed to verify Peer’s cert
I (23089) wolfssl: Callback override available, will continue
I (23099) wolfssl: wolfSSL Entering ERR_error_string
++++ MQTT TLS Verify Callback for : PreVerify 0, Error -188 (ASN no signer error to confirm failure)
Subject’s domain name is *.s2.eu.hivemq.cloud out of 3 certs
Allowing cert anyways
I (23119) wolfssl: Verify callback overriding error!
I (23129) wolfssl: wolfSSL Leaving ProcessPeerCerts, return 0
I (23129) wolfssl: wolfSSL Leaving DoCertificate, return 0
I (23139) wolfssl: Shrinking input buffer
I (23149) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0
I (23149) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0
I (23159) wolfssl: growing input buffer
I (23159) wolfssl: received record layer msg
I (23169) wolfssl: got HANDSHAKE
I (23169) wolfssl: wolfSSL Entering DoHandShakeMsg()
I (23179) wolfssl: wolfSSL Entering DoHandShakeMsgType
I (23189) wolfssl: processing server key exchange
I (23189) wolfssl: wolfSSL Entering DoServerKeyExchange
I (23199) wolf_hw_sha: someone used. hw is locked…
I (23199) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23209) wolfssl: wolfSSL Entering RsaVerify
I (23239) wolfssl: wolfSSL Using RSA PSS un-padding
I (23239) wolf_hw_sha: someone used. hw is locked…
I (23239) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23239) wolf_hw_sha: someone used. hw is locked…
I (23249) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23259) wolf_hw_sha: someone used. hw is locked…
I (23259) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23269) wolf_hw_sha: someone used. hw is locked…
I (23279) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23289) wolf_hw_sha: someone used. hw is locked…
I (23289) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23299) wolf_hw_sha: someone used. hw is locked…
I (23309) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23319) wolf_hw_sha: someone used. hw is locked…
I (23319) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23329) wolfssl: wolfSSL Leaving RsaVerify, return 64
I (23339) wolf_hw_sha: someone used. hw is locked…
I (23339) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23349) wolfssl: wolfSSL Leaving DoServerKeyExchange, return 0
I (23359) wolfssl: Shrinking input buffer
I (23359) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0
I (23369) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0
I (23379) wolfssl: received record layer msg
I (23389) wolfssl: got HANDSHAKE
I (23389) wolfssl: wolfSSL Entering DoHandShakeMsg()
I (23399) wolfssl: wolfSSL Entering DoHandShakeMsgType
I (23409) wolfssl: processing server hello done
I (23409) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0
I (23419) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0
I (23419) wolfssl: connect state: HELLO_AGAIN
I (23429) wolfssl: connect state: HELLO_AGAIN_REPLY
I (23429) wolfssl: connect state: FIRST_REPLY_DONE
I (23439) wolfssl: connect state: FIRST_REPLY_FIRST
I (23439) wolfssl: wolfSSL Entering SendClientKeyExchange
I (23449) wolfssl: wolfSSL Entering X25519MakeKey
I (23459) wolf_hw_sha: someone used. hw is locked…
I (23459) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23469) wolf_hw_sha: someone used. hw is locked…
I (23479) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (23929) wolfssl: wolfSSL Leaving X25519MakeKey, return 0
I (23929) wolfssl: wolfSSL Entering X25519SharedSecret
I (24379) wolfssl: wolfSSL Leaving X25519SharedSecret, return 0
I (24379) wolfssl: growing output buffer
I (24379) wolfssl: Shrinking output buffer
I (24379) wolf_hw_sha: someone used. hw is locked…
I (24389) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24409) wolf_hw_sha: someone used. hw is locked…
I (24409) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24419) wolf_hw_sha: someone used. hw is locked…
I (24429) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24429) wolf_hw_sha: someone used. hw is locked…
I (24439) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24449) wolf_hw_sha: someone used. hw is locked…
I (24459) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24469) wolf_hw_sha: someone used. hw is locked…
I (24479) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24489) wolf_hw_sha: someone used. hw is locked…
I (24489) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24509) wolf_hw_sha: someone used. hw is locked…
I (24519) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24519) wolf_hw_sha: someone used. hw is locked…
I (24529) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24539) wolf_hw_sha: someone used. hw is locked…
I (24539) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24549) wolf_hw_sha: someone used. hw is locked…
I (24559) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24569) wolf_hw_sha: someone used. hw is locked…
I (24569) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24579) wolf_hw_sha: someone used. hw is locked…
I (24589) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24599) wolf_hw_sha: someone used. hw is locked…
I (24599) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24609) wolf_hw_sha: someone used. hw is locked…
I (24619) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24619) wolf_hw_sha: someone used. hw is locked…
I (24629) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24639) wolf_hw_sha: someone used. hw is locked…
I (24639) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24649) wolf_hw_sha: someone used. hw is locked…
I (24659) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24669) wolf_hw_sha: someone used. hw is locked…
I (24669) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24679) wolf_hw_sha: someone used. hw is locked…
I (24689) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24699) wolf_hw_sha: someone used. hw is locked…
I (24699) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24709) wolf_hw_sha: someone used. hw is locked…
I (24709) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24719) wolf_hw_sha: someone used. hw is locked…
I (24729) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24739) wolf_hw_sha: someone used. hw is locked…
I (24739) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24749) wolfssl: wolfSSL Leaving SendClientKeyExchange, return 0
I (24759) wolfssl: sent: client key exchange
I (24759) wolfssl: connect state: FIRST_REPLY_SECOND
I (24769) wolfssl: connect state: FIRST_REPLY_THIRD
I (24769) wolfssl: growing output buffer
I (24779) wolf_hw_sha: someone used. hw is locked…
I (24789) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24789) wolf_hw_sha: someone used. hw is locked…
I (24799) wolf_hw_sha: the rest of operation will use sw implementation for this sha
I (24809) wolfssl: Shrinking output buffer
I (24809) wolfssl: sent: change cipher spec
I (24819) wolfssl: connect state: FIRST_REPLY_FOURTH
I (24819) wolfssl: wolfSSL Entering SendFinished
I (24829) wolfssl: growing output buffer
I (24829) wolfssl: wolfSSL Entering BuildMessage
I (24839) wolfssl: wolfSSL Leaving BuildMessage, return 0
I (24839) wolfssl: wolfSSL Entering AddSession
I (24849) wolfssl: Shrinking output buffer
I (24849) wolfssl: wolfSSL Leaving SendFinished, return 0
I (24859) wolfssl: sent: finished
I (24859) wolfssl: connect state: FINISHED_DONE
I (24869) wolfssl: wolfSSL error occurred, error = -323
I (24879) wolfssl: wolfSSL Entering SSL_get_error
I (24879) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (24919) wolfssl: wolfSSL Entering wolfSSL_SetCertCbCtx
I (24919) wolfssl: wolfSSL Entering SSL_connect()
I (24919) wolfssl: wolfSSL error occurred, error = -323
I (24929) wolfssl: wolfSSL Entering SSL_get_error
I (24929) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (24969) wolfssl: wolfSSL Entering wolfSSL_SetCertCbCtx
I (24969) wolfssl: wolfSSL Entering SSL_connect()
I (24969) wolfssl: wolfSSL error occurred, error = -323
I (24979) wolfssl: wolfSSL Entering SSL_get_error
I (24979) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (25019) wolfssl: wolfSSL Entering wolfSSL_SetCertCbCtx
I (25019) wolfssl: wolfSSL Entering SSL_connect()
I (25019) wolfssl: received record layer msg
I (25029) wolfssl: got CHANGE CIPHER SPEC
I (25029) wolfssl: growing input buffer
I (25039) wolfssl: received record layer msg
I (25039) wolfssl: got HANDSHAKE
I (25039) wolfssl: wolfSSL Entering DoHandShakeMsg()
I (25049) wolfssl: wolfSSL Entering DoHandShakeMsgType
I (25059) wolfssl: processing finished
I (25059) wolfssl: wolfSSL Entering DoFinished
I (25059) wolfssl: wolfSSL Leaving DoFinished, return 0
I (25069) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0
I (25079) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0
I (25079) wolfssl: connect state: SECOND_REPLY_DONE
I (25089) wolfssl: wolfSSL Entering FreeHandshakeResources
I (25099) wolfssl: Shrinking input buffer
I (25099) wolfssl: wolfSSL Leaving SSL_connect(), return 1
==MQTT Socket Connect: Success (0)
MqttClient_EncodePacket: Len 49, Type Connect (1), ID 0, QoS 0
I (25119) wolfssl: wolfSSL Entering SSL_write()
I (25119) wolfssl: growing output buffer
I (25119) wolfssl: wolfSSL Entering BuildMessage
I (25129) wolfssl: wolfSSL Leaving BuildMessage, return 0
I (25139) wolfssl: Shrinking output buffer
I (25139) wolfssl: wolfSSL Leaving SSL_write(), return 49
MqttSocket_Write: Len=49, Rc=49
MqttClient_WaitType: Type Connect Ack (2), ID 0, State 0-0
I (25159) wolfssl: wolfSSL Entering wolfSSL_read()
I (25159) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25169) wolfssl: wolfSSL Entering ReceiveData()
I (25169) wolfssl: wolfSSL error occurred, error = -323
I (25179) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return -323
I (25189) wolfssl: wolfSSL Entering SSL_get_error
I (25189) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (25229) wolfssl: wolfSSL Entering wolfSSL_read()
I (25229) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25229) wolfssl: wolfSSL Entering ReceiveData()
I (25239) wolfssl: wolfSSL error occurred, error = -323
I (25239) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return -323
I (25249) wolfssl: wolfSSL Entering SSL_get_error
I (25249) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (25289) wolfssl: wolfSSL Entering wolfSSL_read()
I (25289) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25289) wolfssl: wolfSSL Entering ReceiveData()
I (25299) wolfssl: wolfSSL error occurred, error = -323
I (25299) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return -323
I (25309) wolfssl: wolfSSL Entering SSL_get_error
I (25309) wolfssl: wolfSSL Leaving SSL_get_error, return -323
I (25349) wolfssl: wolfSSL Entering wolfSSL_read()
I (25349) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25349) wolfssl: wolfSSL Entering ReceiveData()
I (25359) wolfssl: growing input buffer
I (25359) wolfssl: received record layer msg
I (25369) wolfssl: got app DATA
I (25369) wolfssl: wolfSSL Leaving ReceiveData(), return 2
I (25379) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return 2
MqttSocket_ReadDo: Len=2, Rc=2
I (25389) wolfssl: wolfSSL Entering wolfSSL_read()
I (25389) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25399) wolfssl: wolfSSL Entering ReceiveData()
I (25399) wolfssl: Shrinking input buffer
I (25409) wolfssl: wolfSSL Leaving ReceiveData(), return 67
I (25409) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return 67
MqttSocket_ReadDo: Len=67, Rc=67
MqttClient_DecodePacket: Rc 69, Len 69, Type Connect Ack (2), ID 0, QoS 0, doProps 1
Read Packet: Len 69, Type 2, ID 0
Using INCOMING packet_obj 0x3ffc8dc0
Property CB: Type 31
Reason String: Please check the URL and if your MQTT client supports TLS SNI
MqttClient_DecodePacket: Rc 69, Len 69, Type Connect Ack (2), ID 0, QoS 0, doProps 1
MqttClient_WaitType: rc 0, state 0-0
MqttClient_EncodePacket: Len 38, Type Subscribe (8), ID 1
I (25459) wolfssl: wolfSSL Entering SSL_write()
I (25469) wolfssl: growing output buffer
I (25469) wolfssl: wolfSSL Entering BuildMessage
I (25479) wolfssl: wolfSSL Leaving BuildMessage, return 0
I (25489) wolfssl: Shrinking output buffer
I (25489) wolfssl: wolfSSL Leaving SSL_write(), return 38
MqttSocket_Write: Len=38, Rc=38
MqttClient_WaitType: Type Subscribe Ack (9), ID 1, State 0-0
I (25499) wolfssl: wolfSSL Entering wolfSSL_read()
I (25509) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25509) wolfssl: wolfSSL Entering ReceiveData()
I (25519) wolfssl: growing input buffer
I (25529) wolfssl: received record layer msg
I (25529) wolfssl: got ALERT!
I (25529) wolfssl: Alert type: close_notify
I (25539) wolfssl: wolfSSL error occurred, error = 0
I (25539) wolfssl: wolfSSL error occurred, error = -343
I (25549) wolfssl: Zero return, no more data coming
I (25549) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return 0
I (25589) wolfssl: wolfSSL Entering wolfSSL_read()
I (25589) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25589) wolfssl: wolfSSL Entering ReceiveData()
I (25599) wolfssl: User calling wolfSSL_read in error state, not allowed
I (25599) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return -343
I (25609) wolfssl: wolfSSL Entering SSL_get_error
I (25619) wolfssl: wolfSSL Leaving SSL_get_error, return -343
MqttSocket_ReadDo: SSL Error=6 (rc -1, sockrc 0)
I (25659) wolfssl: wolfSSL Entering wolfSSL_read()
I (25659) wolfssl: wolfSSL Entering wolfSSL_read_internal()
I (25659) wolfssl: wolfSSL Entering ReceiveData()
I (25669) wolfssl: User calling wolfSSL_read in error state, not allowed
I (25669) wolfssl: wolfSSL Leaving wolfSSL_read_internal(), return -343
I (25679) wolfssl: wolfSSL Entering SSL_get_error
I (25689) wolfssl: wolfSSL Leaving SSL_get_error, return -343
MqttSocket_ReadDo: SSL Error=6 (rc -1, sockrc 0)

Hi @george_s ,
Great that you are interested in MQTT and HiveMQ! Welcome to our community.

You indicated you have enabled SNI, but your log shows different. I can see your client receiving error -323 from the server and then asking to check if your client has TLS SNI extension enabled:

As WoflSSL explained, “-313” means that the server has sent back a Fatal Alert to the client. If this happens after the ClientHello message is sent, this most likely means that the client is not broadcasting support for a cipher suite or extension that the server requires."

So it seems your client does not really have TLS SNI enabled. Did you double-check the “Client Hello” packet in the Wireshark already, how it is shown here, can you provide your screenshot?

Regards,
Dasha from HiveMQ support

hi @Daria_H ,
I did find the culprit. Although I had compiled wolfssl/wolfmqtt with the correct options/arguments (sni and alt-certchains) and TLS SNI was on, the sni host string in the ‘client hello’ packet was wrong and didn’t match the hive cloud host. When I fixed it, it worked with no issues using the ISRG Root X1 certificate.

Thank you for your support!

1 Like

Thank you for the update @george_s !
I am happy we could make it work together :+1: