# Wolfssl/wolfmqtt to connect to hive cloud **URL:** \ **Category:** HiveMQ Cloud\ **Created:** [September 5, 2022, 7:41pm UTC](https://community.hivemq.com/t/wolfssl-wolfmqtt-to-connect-to-hive-cloud/1407 "2022-09-05T19:41:38Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![george\_s](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@george\_s](https://community.hivemq.com/u/george_s)\ **Post date:** [September 5, 2022, 7:41pm UTC](https://community.hivemq.com/t/wolfssl-wolfmqtt-to-connect-to-hive-cloud/1407/1 "2022-09-05T19:41:38Z")
I am trying to use non blocking wolfssl/wolfmqtt to connect to hive cloud (free at the moment and paid later on if we manage to actualy use it) with url 483a5ca0b4ad42a2be466e77a64b59d5.s2.eu.hivemq.cloud following the advice here ([wolfMQTT Client Supports HiveMQ Cloud - wolfSSL](https://www.wolfssl.com/wolfmqtt-client-supports-hivemq-cloud/)) i have enabled SNI and build it with “–enable-altcertchains” but when i run openssl s\_client -connect 483a5ca0b4ad42a2be466e77a64b59d5.s2.eu.hivemq.cloud:8883 -showcerts \< /dev/null 2\> /dev/null | sed -n ‘/BEGIN/,/END/p’ \> server.pem the last certificate i get is 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1 i:O = Digital Signature Trust Co., CN = DST Root CA X3 Is the “DST Root CA X3” the one that expired on Sept 2021? following this [Need certificate to achieve SSL connexion - #2 by Daria\_H](https://community.hivemq.com/t/need-certificate-to-achieve-ssl-connexion/1387/2) and this [WolfSSL seems to be unable to use Let's encrypt certificates after DST Root CA X3 Expiration · Issue #4443 · wolfSSL/wolfssl · GitHub](https://github.com/wolfSSL/wolfssl/issues/4443#issuecomment-934926793) I added the provided isrgrootx1.pem as a CA but i still get errors when trying to connect. i can connect to mozilla 8883 with no problem. Any help would be apriaceted This is the debug output and the error codes from wolfssl WANT\_READ = -323, /\* want read, call again _/ ZERO\_RETURN = -343, /_ peer sent close notify \*/ – debug output MQTT Client: QoS 1, Use TLS 1 MQTT Net Init: Success (0) MQTT Init: Success (0) NetConnect: Host 483a5ca0b4ad42a2be466e77a64b59d5.s2.eu.hivemq.cloud, Port 8883, Timeout 5000 ms, Use TLS 1 I (20919) wolfssl: wolfSSL Entering wolfSSL\_Init I (20919) wolfssl: wolfSSL Entering wolfCrypt\_Init I (20919) wolfssl: wolfSSL Entering SSLv23\_client\_method\_ex I (20919) wolfssl: wolfSSL Entering wolfSSL\_CTX\_new\_ex I (20929) wolfssl: wolfSSL Entering wolfSSL\_CertManagerNew I (20929) wolfssl: wolfSSL Leaving WOLFSSL\_CTX\_new, return 0 I (20939) wolfssl: wolfSSL Entering wolfSSL\_CTX\_set\_verify I (21149) wolfssl: wolfSSL Entering wolfSSL\_CTX\_load\_verify\_buffer\_ex I (21149) wolfssl: Processing CA PEM file I (21149) wolfssl: wolfSSL Entering PemToDer I (21149) wolfssl: Adding a CA I (21159) wolfssl: wolfSSL Entering GetExplicitVersion I (21159) wolfssl: wolfSSL Entering wc\_GetSerialNumber I (21169) wolfssl: Got Cert Header I (21169) wolfssl: wolfSSL Entering GetAlgoId I (21179) wolfssl: wolfSSL Entering GetObjectId() I (21179) wolfssl: Got Algo ID I (21189) wolfssl: Getting Cert Name I (21189) wolfssl: Getting Cert Name I (21189) wolfssl: Getting Cert Name I (21199) wolfssl: Getting Cert Name I (21199) wolfssl: Got Subject Name I (21209) wolfssl: wolfSSL Entering GetAlgoId I (21209) wolfssl: wolfSSL Entering GetObjectId() I (21219) wolfssl: Got Key I (21219) wolfssl: Parsed Past Key I (21219) wolfssl: wolfSSL Entering DecodeCertExtensions I (21229) wolfssl: wolfSSL Entering GetObjectId() I (21239) wolfssl: wolfSSL Entering DecodeKeyUsage I (21239) wolfssl: wolfSSL Entering GetObjectId() I (21249) wolfssl: wolfSSL Entering DecodeBasicCaConstraint I (21249) wolfssl: wolfSSL Entering GetObjectId() I (21259) wolfssl: wolfSSL Entering DecodeSubjKeyId I (21259) wolfssl: wolfSSL Entering GetAlgoId I (21269) wolfssl: wolfSSL Entering GetObjectId() I (21269) wolfssl: Parsed new CA I (21279) wolfssl: Freeing Parsed CA I (21279) wolfssl: Freeing der CA I (21289) wolfssl: OK Freeing der CA I (21289) wolfssl: wolfSSL Leaving AddCA, return 0 I (21299) wolfssl: Processed a CA I (21299) wolfssl: Processed at least one valid CA. Other stuff OK I (21309) wolfssl: wolfSSL Leaving wolfSSL\_CTX\_load\_verify\_buffer\_ex, return 1 MQTT TLS Setup (1) I (21519) wolfssl: wolfSSL Entering SSL\_new I (21519) wolfssl: wolfSSL Leaving SSL\_new, return 0 I (21519) wolfssl: wolfSSL Entering wolfSSL\_SetCertCbCtx I (21519) wolfssl: wolfSSL Entering SSL\_connect() I (21529) wolfssl: wolfSSL Entering SendTls13ClientHello I (21529) wolfssl: Adding signature algorithms extension I (21539) wolfssl: Adding supported versions extension I (21549) wolfssl: wolfSSL Entering EccMakeKey I (21979) wolfssl: wolfSSL Leaving EccMakeKey, return 0 I (21979) wolfssl: growing output buffer I (21979) wolfssl: Key Share extension to write I (21989) wolfssl: Supported Versions extension to write I (21989) wolfssl: Signature Algorithms extension to write I (21999) wolfssl: Point Formats extension to write I (21999) wolfssl: Supported Groups extension to write I (22009) wolf\_hw\_sha: someone used. hw is locked… I (22019) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22019) wolf\_hw\_sha: someone used. hw is locked… I (22029) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22039) wolfssl: Shrinking output buffer I (22039) wolfssl: wolfSSL Leaving SendTls13ClientHello, return 0 I (22049) wolfssl: connect state: CLIENT\_HELLO\_SENT I (22059) wolfssl: wolfSSL error occurred, error = -323 I (22059) wolfssl: wolfSSL Entering SSL\_get\_error I (22069) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (22099) wolfssl: wolfSSL Entering wolfSSL\_SetCertCbCtx I (22099) wolfssl: wolfSSL Entering SSL\_connect() I (22099) wolfssl: wolfSSL error occurred, error = -323 I (22099) wolfssl: wolfSSL Entering SSL\_get\_error I (22109) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (22139) wolfssl: wolfSSL Entering wolfSSL\_SetCertCbCtx I (22139) wolfssl: wolfSSL Entering SSL\_connect() I (22139) wolfssl: wolfSSL error occurred, error = -323 I (22139) wolfssl: wolfSSL Entering SSL\_get\_error I (22149) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (22179) wolfssl: wolfSSL Entering wolfSSL\_SetCertCbCtx I (22179) wolfssl: wolfSSL Entering SSL\_connect() I (22179) wolfssl: growing input buffer I (22179) wolfssl: received record layer msg I (22189) wolfssl: got HANDSHAKE I (22189) wolfssl: wolfSSL Entering DoTls13HandShakeMsg() I (22199) wolfssl: wolfSSL Entering DoTls13HandShakeMsgType I (22199) wolfssl: processing server hello I (22209) wolfssl: wolfSSL Entering DoTls13ServerHello I (22209) wolfssl: Point Formats extension received I (22219) wolfssl: wolfSSL Entering VerifyClientSuite I (22219) wolfssl: wolfSSL Leaving DoTls13ServerHello, return 0 I (22229) wolfssl: Shrinking input buffer I (22229) wolfssl: wolfSSL Leaving DoTls13HandShakeMsgType(), return 0 I (22239) wolfssl: wolfSSL Leaving DoTls13HandShakeMsg(), return 0 I (22249) wolfssl: growing input buffer I (22259) wolfssl: received record layer msg I (22259) wolfssl: got HANDSHAKE I (22259) wolfssl: wolfSSL Entering DoHandShakeMsg() I (22269) wolfssl: wolfSSL Entering DoHandShakeMsgType I (22279) wolfssl: processing certificate I (22279) wolfssl: wolfSSL Entering DoCertificate I (22279) wolfssl: wolfSSL Entering ProcessPeerCerts I (22289) wolfssl: Loading peer’s cert chain I (22289) wolfssl: Put another cert into chain I (22299) wolfssl: Put another cert into chain I (22299) wolfssl: Put another cert into chain I (22309) wolfssl: wolfSSL Entering GetExplicitVersion I (22319) wolfssl: wolfSSL Entering wc\_GetSerialNumber I (22319) wolfssl: Got Cert Header I (22329) wolfssl: wolfSSL Entering GetAlgoId I (22329) wolfssl: wolfSSL Entering GetObjectId() I (22339) wolfssl: Got Algo ID I (22339) wolfssl: Getting Cert Name I (22339) wolfssl: Getting Cert Name I (22349) wolf\_hw\_sha: someone used. hw is locked… I (22349) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22359) wolfssl: Getting Cert Name I (22369) wolfssl: Getting Cert Name I (22369) wolf\_hw\_sha: someone used. hw is locked… I (22379) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22389) wolfssl: Got Subject Name I (22389) wolfssl: wolfSSL Entering GetAlgoId I (22389) wolfssl: wolfSSL Entering GetObjectId() I (22399) wolfssl: Got Key I (22399) wolfssl: Parsed Past Key I (22409) wolfssl: wolfSSL Entering DecodeCertExtensions I (22409) wolfssl: wolfSSL Entering GetObjectId() I (22419) wolfssl: wolfSSL Entering DecodeBasicCaConstraint I (22419) wolfssl: wolfSSL Entering GetObjectId() I (22429) wolfssl: wolfSSL Entering DecodeKeyUsage I (22439) wolfssl: wolfSSL Entering GetObjectId() I (22439) wolfssl: wolfSSL Entering DecodeAuthInfo I (22449) wolfssl: wolfSSL Entering GetObjectId() I (22449) wolfssl: wolfSSL Entering GetObjectId() I (22459) wolfssl: wolfSSL Entering DecodeAuthKeyId I (22459) wolfssl: wolfSSL Entering GetObjectId() I (22469) wolfssl: Certificate Policy extension not supported yet. I (22479) wolfssl: wolfSSL Entering GetObjectId() I (22479) wolfssl: wolfSSL Entering DecodeCrlDist I (22489) wolfssl: wolfSSL Entering GetObjectId() I (22489) wolfssl: wolfSSL Entering DecodeSubjKeyId I (22499) wolfssl: wolfSSL Entering GetAlgoId I (22499) wolfssl: wolfSSL Entering GetObjectId() I (22509) wolfssl: No CA signer to verify with I (22509) wolfssl: Failed to verify CA from chain I (22519) wolfssl: Trying alternate cert chain I (22519) wolfssl: wolfSSL Entering GetExplicitVersion I (22529) wolfssl: wolfSSL Entering wc\_GetSerialNumber I (22529) wolfssl: Got Cert Header I (22539) wolfssl: wolfSSL Entering GetAlgoId I (22539) wolfssl: wolfSSL Entering GetObjectId() I (22549) wolfssl: Got Algo ID I (22549) wolfssl: Getting Cert Name I (22559) wolfssl: Getting Cert Name I (22559) wolf\_hw\_sha: someone used. hw is locked… I (22569) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22579) wolfssl: Getting Cert Name I (22579) wolfssl: Getting Cert Name I (22579) wolf\_hw\_sha: someone used. hw is locked… I (22589) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22599) wolfssl: Got Subject Name I (22599) wolfssl: wolfSSL Entering GetAlgoId I (22609) wolfssl: wolfSSL Entering GetObjectId() I (22609) wolfssl: Got Key I (22619) wolfssl: Parsed Past Key I (22619) wolfssl: wolfSSL Entering DecodeCertExtensions I (22629) wolfssl: wolfSSL Entering GetObjectId() I (22629) wolfssl: wolfSSL Entering DecodeKeyUsage I (22639) wolfssl: wolfSSL Entering GetObjectId() I (22639) wolfssl: wolfSSL Entering DecodeExtKeyUsage I (22649) wolfssl: wolfSSL Entering GetObjectId() I (22649) wolfssl: wolfSSL Entering GetObjectId() I (22659) wolfssl: wolfSSL Entering GetObjectId() I (22659) wolfssl: wolfSSL Entering DecodeBasicCaConstraint I (22669) wolfssl: wolfSSL Entering GetObjectId() I (22679) wolfssl: wolfSSL Entering DecodeSubjKeyId I (22679) wolfssl: wolfSSL Entering GetObjectId() I (22699) wolfssl: wolfSSL Entering DecodeAuthKeyId I (22699) wolfssl: wolfSSL Entering GetObjectId() I (22709) wolfssl: wolfSSL Entering DecodeAuthInfo I (22719) wolfssl: wolfSSL Entering GetObjectId() I (22719) wolfssl: wolfSSL Entering GetObjectId() I (22729) wolfssl: wolfSSL Entering DecodeCrlDist I (22729) wolfssl: wolfSSL Entering GetObjectId() I (22739) wolfssl: Certificate Policy extension not supported yet. I (22739) wolfssl: wolfSSL Entering GetAlgoId I (22749) wolfssl: wolfSSL Entering GetObjectId() I (22749) wolfssl: CA found I (22759) wolfssl: CA boolean set I (22759) wolfssl: Extension Key Usage Set I (22769) wolfssl: maxPathLen status: set to pathLength I (22769) wolfssl: wolfSSL Entering ConfirmSignature I (22779) wolf\_hw\_sha: someone used. hw is locked… I (22779) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22789) wolfssl: RSA\_FUNCTION MP\_EXPTMOD\_E: memory/config problem I (22799) wolfssl: wolfSSL Leaving ConfirmSignature, return -155 I (22809) wolfssl: Confirm signature failed I (22809) wolfssl: Failed to verify CA from chain I (22819) wolfssl: wolfSSL Entering ERR\_error\_string ++++ MQTT TLS Verify Callback for : PreVerify 0, Error -155 (ASN sig error, confirm failure) Subject’s domain name is R3 out of 3 certs Allowing cert anyways I (22839) wolfssl: Verify callback overriding error! I (22839) wolfssl: Verifying Peer’s cert I (22849) wolfssl: wolfSSL Entering GetExplicitVersion I (22849) wolfssl: wolfSSL Entering wc\_GetSerialNumber I (22859) wolfssl: Got Cert Header I (22859) wolfssl: wolfSSL Entering GetAlgoId I (22869) wolfssl: wolfSSL Entering GetObjectId() I (22869) wolfssl: Got Algo ID I (22879) wolfssl: Getting Cert Name I (22879) wolfssl: Getting Cert Name I (22889) wolf\_hw\_sha: someone used. hw is locked… I (22889) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22899) wolfssl: Getting Cert Name I (22899) wolfssl: Getting Cert Name I (22909) wolf\_hw\_sha: someone used. hw is locked… I (22909) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (22919) wolfssl: Got Subject Name I (22929) wolfssl: wolfSSL Entering GetAlgoId I (22929) wolfssl: wolfSSL Entering GetObjectId() I (22939) wolfssl: Got Key I (22939) wolfssl: Parsed Past Key I (22939) wolfssl: wolfSSL Entering DecodeCertExtensions I (22949) wolfssl: wolfSSL Entering GetObjectId() I (22959) wolfssl: wolfSSL Entering DecodeKeyUsage I (22959) wolfssl: wolfSSL Entering GetObjectId() I (22979) wolfssl: wolfSSL Entering DecodeExtKeyUsage I (22979) wolfssl: wolfSSL Entering GetObjectId() I (22989) wolfssl: wolfSSL Entering GetObjectId() I (22989) wolfssl: wolfSSL Entering GetObjectId() I (22999) wolfssl: wolfSSL Entering DecodeBasicCaConstraint I (23009) wolfssl: wolfSSL Entering GetObjectId() I (23009) wolfssl: wolfSSL Entering DecodeSubjKeyId I (23019) wolfssl: wolfSSL Entering GetObjectId() I (23019) wolfssl: wolfSSL Entering DecodeAuthKeyId I (23029) wolfssl: wolfSSL Entering GetObjectId() I (23029) wolfssl: wolfSSL Entering DecodeAuthInfo I (23039) wolfssl: wolfSSL Entering GetObjectId() I (23039) wolfssl: wolfSSL Entering GetObjectId() I (23049) wolfssl: wolfSSL Entering DecodeAltNames I (23049) wolfssl: wolfSSL Entering GetObjectId() I (23059) wolfssl: Certificate Policy extension not supported yet. I (23069) wolfssl: wolfSSL Entering GetObjectId() I (23069) wolfssl: wolfSSL Entering GetAlgoId I (23079) wolfssl: wolfSSL Entering GetObjectId() I (23079) wolfssl: No CA signer to verify with I (23089) wolfssl: Failed to verify Peer’s cert I (23089) wolfssl: Callback override available, will continue I (23099) wolfssl: wolfSSL Entering ERR\_error\_string ++++ MQTT TLS Verify Callback for : PreVerify 0, Error -188 (ASN no signer error to confirm failure) Subject’s domain name is \*.s2.eu.hivemq.cloud out of 3 certs Allowing cert anyways I (23119) wolfssl: Verify callback overriding error! I (23129) wolfssl: wolfSSL Leaving ProcessPeerCerts, return 0 I (23129) wolfssl: wolfSSL Leaving DoCertificate, return 0 I (23139) wolfssl: Shrinking input buffer I (23149) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0 I (23149) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0 I (23159) wolfssl: growing input buffer I (23159) wolfssl: received record layer msg I (23169) wolfssl: got HANDSHAKE I (23169) wolfssl: wolfSSL Entering DoHandShakeMsg() I (23179) wolfssl: wolfSSL Entering DoHandShakeMsgType I (23189) wolfssl: processing server key exchange I (23189) wolfssl: wolfSSL Entering DoServerKeyExchange I (23199) wolf\_hw\_sha: someone used. hw is locked… I (23199) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23209) wolfssl: wolfSSL Entering RsaVerify I (23239) wolfssl: wolfSSL Using RSA PSS un-padding I (23239) wolf\_hw\_sha: someone used. hw is locked… I (23239) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23239) wolf\_hw\_sha: someone used. hw is locked… I (23249) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23259) wolf\_hw\_sha: someone used. hw is locked… I (23259) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23269) wolf\_hw\_sha: someone used. hw is locked… I (23279) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23289) wolf\_hw\_sha: someone used. hw is locked… I (23289) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23299) wolf\_hw\_sha: someone used. hw is locked… I (23309) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23319) wolf\_hw\_sha: someone used. hw is locked… I (23319) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23329) wolfssl: wolfSSL Leaving RsaVerify, return 64 I (23339) wolf\_hw\_sha: someone used. hw is locked… I (23339) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23349) wolfssl: wolfSSL Leaving DoServerKeyExchange, return 0 I (23359) wolfssl: Shrinking input buffer I (23359) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0 I (23369) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0 I (23379) wolfssl: received record layer msg I (23389) wolfssl: got HANDSHAKE I (23389) wolfssl: wolfSSL Entering DoHandShakeMsg() I (23399) wolfssl: wolfSSL Entering DoHandShakeMsgType I (23409) wolfssl: processing server hello done I (23409) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0 I (23419) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0 I (23419) wolfssl: connect state: HELLO\_AGAIN I (23429) wolfssl: connect state: HELLO\_AGAIN\_REPLY I (23429) wolfssl: connect state: FIRST\_REPLY\_DONE I (23439) wolfssl: connect state: FIRST\_REPLY\_FIRST I (23439) wolfssl: wolfSSL Entering SendClientKeyExchange I (23449) wolfssl: wolfSSL Entering X25519MakeKey I (23459) wolf\_hw\_sha: someone used. hw is locked… I (23459) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23469) wolf\_hw\_sha: someone used. hw is locked… I (23479) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (23929) wolfssl: wolfSSL Leaving X25519MakeKey, return 0 I (23929) wolfssl: wolfSSL Entering X25519SharedSecret I (24379) wolfssl: wolfSSL Leaving X25519SharedSecret, return 0 I (24379) wolfssl: growing output buffer I (24379) wolfssl: Shrinking output buffer I (24379) wolf\_hw\_sha: someone used. hw is locked… I (24389) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24409) wolf\_hw\_sha: someone used. hw is locked… I (24409) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24419) wolf\_hw\_sha: someone used. hw is locked… I (24429) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24429) wolf\_hw\_sha: someone used. hw is locked… I (24439) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24449) wolf\_hw\_sha: someone used. hw is locked… I (24459) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24469) wolf\_hw\_sha: someone used. hw is locked… I (24479) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24489) wolf\_hw\_sha: someone used. hw is locked… I (24489) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24509) wolf\_hw\_sha: someone used. hw is locked… I (24519) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24519) wolf\_hw\_sha: someone used. hw is locked… I (24529) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24539) wolf\_hw\_sha: someone used. hw is locked… I (24539) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24549) wolf\_hw\_sha: someone used. hw is locked… I (24559) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24569) wolf\_hw\_sha: someone used. hw is locked… I (24569) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24579) wolf\_hw\_sha: someone used. hw is locked… I (24589) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24599) wolf\_hw\_sha: someone used. hw is locked… I (24599) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24609) wolf\_hw\_sha: someone used. hw is locked… I (24619) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24619) wolf\_hw\_sha: someone used. hw is locked… I (24629) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24639) wolf\_hw\_sha: someone used. hw is locked… I (24639) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24649) wolf\_hw\_sha: someone used. hw is locked… I (24659) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24669) wolf\_hw\_sha: someone used. hw is locked… I (24669) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24679) wolf\_hw\_sha: someone used. hw is locked… I (24689) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24699) wolf\_hw\_sha: someone used. hw is locked… I (24699) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24709) wolf\_hw\_sha: someone used. hw is locked… I (24709) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24719) wolf\_hw\_sha: someone used. hw is locked… I (24729) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24739) wolf\_hw\_sha: someone used. hw is locked… I (24739) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24749) wolfssl: wolfSSL Leaving SendClientKeyExchange, return 0 I (24759) wolfssl: sent: client key exchange I (24759) wolfssl: connect state: FIRST\_REPLY\_SECOND I (24769) wolfssl: connect state: FIRST\_REPLY\_THIRD I (24769) wolfssl: growing output buffer I (24779) wolf\_hw\_sha: someone used. hw is locked… I (24789) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24789) wolf\_hw\_sha: someone used. hw is locked… I (24799) wolf\_hw\_sha: the rest of operation will use sw implementation for this sha I (24809) wolfssl: Shrinking output buffer I (24809) wolfssl: sent: change cipher spec I (24819) wolfssl: connect state: FIRST\_REPLY\_FOURTH I (24819) wolfssl: wolfSSL Entering SendFinished I (24829) wolfssl: growing output buffer I (24829) wolfssl: wolfSSL Entering BuildMessage I (24839) wolfssl: wolfSSL Leaving BuildMessage, return 0 I (24839) wolfssl: wolfSSL Entering AddSession I (24849) wolfssl: Shrinking output buffer I (24849) wolfssl: wolfSSL Leaving SendFinished, return 0 I (24859) wolfssl: sent: finished I (24859) wolfssl: connect state: FINISHED\_DONE I (24869) wolfssl: wolfSSL error occurred, error = -323 I (24879) wolfssl: wolfSSL Entering SSL\_get\_error I (24879) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (24919) wolfssl: wolfSSL Entering wolfSSL\_SetCertCbCtx I (24919) wolfssl: wolfSSL Entering SSL\_connect() I (24919) wolfssl: wolfSSL error occurred, error = -323 I (24929) wolfssl: wolfSSL Entering SSL\_get\_error I (24929) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (24969) wolfssl: wolfSSL Entering wolfSSL\_SetCertCbCtx I (24969) wolfssl: wolfSSL Entering SSL\_connect() I (24969) wolfssl: wolfSSL error occurred, error = -323 I (24979) wolfssl: wolfSSL Entering SSL\_get\_error I (24979) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (25019) wolfssl: wolfSSL Entering wolfSSL\_SetCertCbCtx I (25019) wolfssl: wolfSSL Entering SSL\_connect() I (25019) wolfssl: received record layer msg I (25029) wolfssl: got CHANGE CIPHER SPEC I (25029) wolfssl: growing input buffer I (25039) wolfssl: received record layer msg I (25039) wolfssl: got HANDSHAKE I (25039) wolfssl: wolfSSL Entering DoHandShakeMsg() I (25049) wolfssl: wolfSSL Entering DoHandShakeMsgType I (25059) wolfssl: processing finished I (25059) wolfssl: wolfSSL Entering DoFinished I (25059) wolfssl: wolfSSL Leaving DoFinished, return 0 I (25069) wolfssl: wolfSSL Leaving DoHandShakeMsgType(), return 0 I (25079) wolfssl: wolfSSL Leaving DoHandShakeMsg(), return 0 I (25079) wolfssl: connect state: SECOND\_REPLY\_DONE I (25089) wolfssl: wolfSSL Entering FreeHandshakeResources I (25099) wolfssl: Shrinking input buffer I (25099) wolfssl: wolfSSL Leaving SSL\_connect(), return 1 ==MQTT Socket Connect: Success (0) MqttClient\_EncodePacket: Len 49, Type Connect (1), ID 0, QoS 0 I (25119) wolfssl: wolfSSL Entering SSL\_write() I (25119) wolfssl: growing output buffer I (25119) wolfssl: wolfSSL Entering BuildMessage I (25129) wolfssl: wolfSSL Leaving BuildMessage, return 0 I (25139) wolfssl: Shrinking output buffer I (25139) wolfssl: wolfSSL Leaving SSL\_write(), return 49 MqttSocket\_Write: Len=49, Rc=49 MqttClient\_WaitType: Type Connect Ack (2), ID 0, State 0-0 I (25159) wolfssl: wolfSSL Entering wolfSSL\_read() I (25159) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25169) wolfssl: wolfSSL Entering ReceiveData() I (25169) wolfssl: wolfSSL error occurred, error = -323 I (25179) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return -323 I (25189) wolfssl: wolfSSL Entering SSL\_get\_error I (25189) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (25229) wolfssl: wolfSSL Entering wolfSSL\_read() I (25229) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25229) wolfssl: wolfSSL Entering ReceiveData() I (25239) wolfssl: wolfSSL error occurred, error = -323 I (25239) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return -323 I (25249) wolfssl: wolfSSL Entering SSL\_get\_error I (25249) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (25289) wolfssl: wolfSSL Entering wolfSSL\_read() I (25289) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25289) wolfssl: wolfSSL Entering ReceiveData() I (25299) wolfssl: wolfSSL error occurred, error = -323 I (25299) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return -323 I (25309) wolfssl: wolfSSL Entering SSL\_get\_error I (25309) wolfssl: wolfSSL Leaving SSL\_get\_error, return -323 I (25349) wolfssl: wolfSSL Entering wolfSSL\_read() I (25349) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25349) wolfssl: wolfSSL Entering ReceiveData() I (25359) wolfssl: growing input buffer I (25359) wolfssl: received record layer msg I (25369) wolfssl: got app DATA I (25369) wolfssl: wolfSSL Leaving ReceiveData(), return 2 I (25379) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return 2 MqttSocket\_ReadDo: Len=2, Rc=2 I (25389) wolfssl: wolfSSL Entering wolfSSL\_read() I (25389) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25399) wolfssl: wolfSSL Entering ReceiveData() I (25399) wolfssl: Shrinking input buffer I (25409) wolfssl: wolfSSL Leaving ReceiveData(), return 67 I (25409) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return 67 MqttSocket\_ReadDo: Len=67, Rc=67 MqttClient\_DecodePacket: Rc 69, Len 69, Type Connect Ack (2), ID 0, QoS 0, doProps 1 Read Packet: Len 69, Type 2, ID 0 Using INCOMING packet\_obj 0x3ffc8dc0 Property CB: Type 31 Reason String: Please check the URL and if your MQTT client supports TLS SNI MqttClient\_DecodePacket: Rc 69, Len 69, Type Connect Ack (2), ID 0, QoS 0, doProps 1 MqttClient\_WaitType: rc 0, state 0-0 MqttClient\_EncodePacket: Len 38, Type Subscribe (8), ID 1 I (25459) wolfssl: wolfSSL Entering SSL\_write() I (25469) wolfssl: growing output buffer I (25469) wolfssl: wolfSSL Entering BuildMessage I (25479) wolfssl: wolfSSL Leaving BuildMessage, return 0 I (25489) wolfssl: Shrinking output buffer I (25489) wolfssl: wolfSSL Leaving SSL\_write(), return 38 MqttSocket\_Write: Len=38, Rc=38 MqttClient\_WaitType: Type Subscribe Ack (9), ID 1, State 0-0 I (25499) wolfssl: wolfSSL Entering wolfSSL\_read() I (25509) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25509) wolfssl: wolfSSL Entering ReceiveData() I (25519) wolfssl: growing input buffer I (25529) wolfssl: received record layer msg I (25529) wolfssl: got ALERT! I (25529) wolfssl: Alert type: close\_notify I (25539) wolfssl: wolfSSL error occurred, error = 0 I (25539) wolfssl: wolfSSL error occurred, error = -343 I (25549) wolfssl: Zero return, no more data coming I (25549) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return 0 I (25589) wolfssl: wolfSSL Entering wolfSSL\_read() I (25589) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25589) wolfssl: wolfSSL Entering ReceiveData() I (25599) wolfssl: User calling wolfSSL\_read in error state, not allowed I (25599) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return -343 I (25609) wolfssl: wolfSSL Entering SSL\_get\_error I (25619) wolfssl: wolfSSL Leaving SSL\_get\_error, return -343 MqttSocket\_ReadDo: SSL Error=6 (rc -1, sockrc 0) I (25659) wolfssl: wolfSSL Entering wolfSSL\_read() I (25659) wolfssl: wolfSSL Entering wolfSSL\_read\_internal() I (25659) wolfssl: wolfSSL Entering ReceiveData() I (25669) wolfssl: User calling wolfSSL\_read in error state, not allowed I (25669) wolfssl: wolfSSL Leaving wolfSSL\_read\_internal(), return -343 I (25679) wolfssl: wolfSSL Entering SSL\_get\_error I (25689) wolfssl: wolfSSL Leaving SSL\_get\_error, return -343 MqttSocket\_ReadDo: SSL Error=6 (rc -1, sockrc 0) ---
**Author:** ![Daria\_H](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@Daria\_H](https://community.hivemq.com/u/Daria_H)\ **Post date:** [September 6, 2022, 7:23am UTC](https://community.hivemq.com/t/wolfssl-wolfmqtt-to-connect-to-hive-cloud/1407/2 "2022-09-06T07:23:32Z")
Hi @george_s , Great that you are interested in MQTT and HiveMQ! Welcome to our community. You indicated you have enabled SNI, but your log shows different. I can see your client receiving error -323 from the server and then asking to check if your client has TLS SNI extension enabled: > [@george\_s](#): > > I (25239) wolfssl: wolfSSL error occurred, error = -323 > [@george\_s](#): > > Reason String: Please check the URL and if your MQTT client supports TLS SNI [As WoflSSL explained](https://www.wolfssl.com/forums/topic839-solved-err-313-revcd-alert-fatal-error.html#pc2666), “-313” means that the server has sent back a Fatal Alert to the client. If this happens after the ClientHello message is sent, this most likely means that the client is not broadcasting support for a cipher suite or extension that the server requires." So it seems your client does not really have TLS SNI enabled. Did you double-check the “Client Hello” packet in the Wireshark already, how [it is shown here](https://community.hivemq.com/t/client-is-not-authorized-to-connect/856/37), can you provide your screenshot? Regards, Dasha from HiveMQ support ---
**Author:** ![george\_s](https://avatars.discourse-cdn.com/v4/letter/g/97f17d/32.png) [@george\_s](https://community.hivemq.com/u/george_s)\ **Post date:** [September 7, 2022, 2:32pm UTC](https://community.hivemq.com/t/wolfssl-wolfmqtt-to-connect-to-hive-cloud/1407/3 "2022-09-07T14:32:08Z")
hi @Daria_H , I did find the culprit. Although I had compiled wolfssl/wolfmqtt with the correct options/arguments (sni and alt-certchains) and TLS SNI was on, the sni host string in the ‘client hello’ packet was wrong and didn’t match the hive cloud host. When I fixed it, it worked with no issues using the ISRG Root X1 certificate. Thank you for your support! ---
**Author:** ![Daria\_H](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@Daria\_H](https://community.hivemq.com/u/Daria_H)\ **Post date:** [September 7, 2022, 2:47pm UTC](https://community.hivemq.com/t/wolfssl-wolfmqtt-to-connect-to-hive-cloud/1407/4 "2022-09-07T14:47:23Z")
Thank you for the update @george_s ! I am happy we could make it work together 👍