Netx Secure Client cert initialize error NX_SECURE_PKCS1_INVALID_PRIVATE_KEY

Question

Netx Secure Client cert initialize error NX_SECURE_PKCS1_INVALID_PRIVATE_KEY

shaun 5

Hi,

I'm using a STM32F732 dev board with threadx, netx + secure.

I have my own mqtt broker and a set of self signed certs, I have tested the broker and client certs using MQTT Explorer and can connect with 2-way cert validation without issue.

I have threadx/netx working with the broker when only using the server cert and no client cert checks, I'm trying to add the client certs into netx secure, however I keep getting the following error when initializing the local cert with the private key = NX_SECURE_PKCS1_INVALID_PRIVATE_KEY.

Drilling down into the code the following check is failing in _nx_secure_x509_pkcs1_rsa_private_key_parse()

/* Parse our next field, the modulus. */

status = _nx_secure_x509_asn1_tlv_block_parse(xxxx xxx xxx xxxx);

xxxxx

if (tlv_type != NX_SECURE_ASN_TAG_INTEGER || tlv_type_class != NX_SECURE_ASN_TAG_CLASS_UNIVERSAL)

tlv_type is set to 16 after the parse, however NX_SECURE_ASN_TAG_INTEGER is set at 2.

The certs have been generated from openssl as follows,

openssl genrsa -out stm32.key -traditional 2048

openssl req -config client.cnf -key stm32.key -new -sha256 -out stm32.csr

openssl ca -config client.cnf -extensions usr_cert -days 365 -notext -md sha256 -in stm32.csr -out stm32.crt

To convert the key / cert to DER for Netx as follows,

openssl rsa -in stm32.key -out stm32_rsa.key -traditional

openssl rsa -in stm32_rsa.key -outform DER -out stm32_rsa.der

xxd -i stm32_rsa.der > stm32_rsa_der.h

I'm assuming I have a format error in the key creation, however not knowing the details of the certs and keys means its hard to tell.

Any guidance would be great.

Shaun

Sander van de Velde | MVP 37,056 Reputation points MVP

2024-05-15T10:57:55.86+00:00

Hello @shaun,

welcome to this moderated Azure community forum.

Better questions with more information lead to better answers from our community members.

Please provide information about the steps you have taken, the guide you follow, and the detailed errors you receive so fellow members can understand your question.

Where do you want to connect to Azure in this flow?
shaun 5 Reputation points

2024-05-15T15:31:53.61+00:00

Hi Sander,

Thank you for coming back quickly.

I think I might have posted in the wrong forum, I need assistance with threadx/netx, however I can't seem to find a suitable forum for this. I assumed Azure IOT would be heavily Threadx based and likely the best place to post, but maybe not.

I've been following the threadx instructions directly,

https://github.com/eclipse-threadx/rtos-docs/blob/main/rtos-docs/netx-duo/netx-duo-secure-tls/chapter3.md

I'm using an example STM32F7 MQTT project that worked with the test mosquitto broker.

I have pointed this to my local network broker (EMQX) and have included TLS with self-signed certs.

This is fine until I try and add a client cert for the STM32 and try to perform 2-way auth, playing around this afternoon I now have netx accepting the cert, however I still can't connect. Looking at wireshark I don't think the board is ever sending a TLS start handshake to the server.

Do you know of a more suitable place to get help with threadx?

Thanks

Shaun
RobertBK 0 Reputation points

2024-07-15T16:17:22.0233333+00:00

Hi @shaun,

I have the same issue when I try to use TLS on the http web server. Do you have any updates on this? Were you able to use your self-signed certificate?

4 answers

Your answer

Sander van de Velde | MVP 37,056 Reputation points MVP

2024-05-15T10:57:55.86+00:00

Hello @shaun,

welcome to this moderated Azure community forum.

Better questions with more information lead to better answers from our community members.

Please provide information about the steps you have taken, the guide you follow, and the detailed errors you receive so fellow members can understand your question.

Where do you want to connect to Azure in this flow?
shaun 5 Reputation points

2024-05-15T15:31:53.61+00:00

Hi Sander,

Thank you for coming back quickly.

I think I might have posted in the wrong forum, I need assistance with threadx/netx, however I can't seem to find a suitable forum for this. I assumed Azure IOT would be heavily Threadx based and likely the best place to post, but maybe not.

I've been following the threadx instructions directly,

https://github.com/eclipse-threadx/rtos-docs/blob/main/rtos-docs/netx-duo/netx-duo-secure-tls/chapter3.md

I'm using an example STM32F7 MQTT project that worked with the test mosquitto broker.

I have pointed this to my local network broker (EMQX) and have included TLS with self-signed certs.

This is fine until I try and add a client cert for the STM32 and try to perform 2-way auth, playing around this afternoon I now have netx accepting the cert, however I still can't connect. Looking at wireshark I don't think the board is ever sending a TLS start handshake to the server.

Do you know of a more suitable place to get help with threadx?

Thanks

Shaun
RobertBK 0 Reputation points

2024-07-15T16:17:22.0233333+00:00

Hi @shaun,

I have the same issue when I try to use TLS on the http web server. Do you have any updates on this? Were you able to use your self-signed certificate?

Answer 1

In Linux, "gcc" refers to the GNU Compiler Collection. [1][2] Here's a breakdown of what that means:

GNU Compiler Collection: GCC is a set of compilers and development tools. [2][3] It's a key part of the GNU toolchain, which is essential for building software on Linux. [4]
Compiling: GCC's primary function is to compile source code (like C, C++, Objective-C, Fortran, Ada, Go, D, Modula-2, and COBOL) into machine code that your computer can execute.
More than just C: Although it was originally named the GNU C Compiler, GCC now supports a wide variety of programming languages. [5][6]
Free Software: The Free Software Foundation (FSF) distributes GCC as free software under the GNU General Public License (GNU GPL). [5][7]
Standard Compiler: GCC has been adopted as the standard compiler by many Unix-like operating systems, including most Linux distributions. [1][5]
Part of the GNU/Linux Ecosystem: GCC is a core component of the GNU toolchain, which is so closely tied to the Linux kernel that the ecosystem is often referred to as GNU/Linux. [4]

In simple terms, GCC in Linux is the tool you use to turn your written code into executable programs. [4]

Learn more:

Answer 2

setenforce gcc -o log_reader your_code_file.c -lmlibrary

dd if=/path/to/inputfile of=/path/to/outputfile bs=512 count=1

#include <mlibrary.h>

readLogs() {

MLibrarySDK sdk;

sdk.initialize();

sdk.readLogcat(); // Custom function to read logs

sdk.cleanup();

}

dd if=C:\path\to\inputfile of=C:\path\to\outputfile bs=512 count=1

06-14 20:13:54.782 30255 30255 V Resources Manager: The following library key has been added: Resourceskey { mHash=e0576fcc mResDir=null msplit Dir s=[] moverlayDirs=[/product/overlay/Navi gati onBar Mode3Button/NavigationB ar Mode 3ButtonOverlay. apk, /product/overlay/IconShapeTeardrop/IconShape Tea rdropOverlay. apk, /product/overlay/Font Rooker yRegul ar/Font Rooker y Regul ar O verlay. apk,/data/resource-cache/com androi d. systemul neutralFDv8. frro,/data/resource-cache/com android. systemui accent-4j Gl.frro,/data/resource -cache/com androi d. systemui dynamic-AFns.frro] mLibDirs=[/data/app/~~CWB 1FsZ28UI Mt_Eo2f Boww==/com.google.androi d. webvi ew- ESMz OUbws] TGocy7W CI Pg= /base, apk,/data/app/~~aBs P8HRDPOEPYqZEUIf_ZA==/com google. android. trich romelibrary.71 51 061 33-nC94v5JJ1gvTzms-3mKdMQ==/base. apk, /system ext/fram ework/androi dx. window. extensions.jar] mbi spl ayl d = 0 mOverride Config=v35 m Compatinfo={400dpi al ways-compat) mLoaders=[]]

Answer 3

Pramod P K 0

Saw a possible solution in another thread..

https://dori-uw-1.kuma-moon.com/en-us/answers/questions/2028115/(azure-rtos-thread-x-version-6-1-9)-nx-secure-x509

Phillip Garcia 0 Reputation points

2025-06-24T00:39:11.5166667+00:00

Defending RFC DNS, Reporter or same?

Answer 4

Hello @shaun,

welcome to this moderated Azure community forum.

On this forum mainly Microsoft Azure and Microsoft tooling questions are answered.

With the Eclipse Foundation as its new home, Azure RTOS now has been renamed to Eclipse ThreadX and the new location is https://github.com/eclipse-threadx/threadx.

You make a better chance for an answer to your questions at that GitHub repo. This can be done using the issues or as the readme says:

You can also check previous questions or ask new ones on StackOverflow using the threadx-rtos and threadx tags.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Share via

Netx Secure Client cert initialize error NX_SECURE_PKCS1_INVALID_PRIVATE_KEY

4 answers

Your answer