Lets protect your identity and confidentiality.  Please send a message to support@wolfssl.com.  There we can further discuss your use-case via a confidential channel.  When you send that message, please reference this forum thread to link the context.  Thank you.

Warm regards, Anthony

I am doing this for an organization, and would be happy to discuss more via email.

Best, James

Can I suggest starting with the simplest and known working examples and then moving to using PKCS11?  Please have a look at these examples:

https://github.com/wolfSSL/wolfssl-exam … nt-tls13.c
https://github.com/wolfSSL/wolfssl-exam … er-tls13.c

Can you let us know a bit about yourself?  We love learning about people that use our code.

- where are you located?
- what are your goals?
- is this out of personal, academic or professional interest?
- is there an organization associated with this work?

Warm regards, Anthony

#ifdef WOLFSSL_TLS13
i (ssl.options.tls1_3) {
return wolfSSL_connect_TLSv13(ssl);
}
#endif

the macro causes the if statement to be called but it fails and wolfSSL_connect_TLSv13(ssL) is not called presumably leading to a version error on the server side. My question is where is ssl.options.tls1_3 set to 1? If it is not explicitly set and just inherits the ctx.options field then where is that happening? I have "--enabled-tls13" as well as set ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method())) == NULL.
I do want to add when I set both server and client to tls 1.2 methods the connection works.
Below is my options.h configuration.

ifdef WOLFSSL_NO_OPTIONS_H
/* options.h inhibited by configuration */
#elif !defined(WOLFSSL_OPTIONS_H)
#define WOLFSSL_OPTIONS_H

#ifdef __cplusplus
extern "C" {
#endif

#undef  WOLFSSL_HAVE_ATOMIC_H
#define WOLFSSL_HAVE_ATOMIC_H

#undef  WOLFSSL_HAVE_ASSERT_H
#define WOLFSSL_HAVE_ASSERT_H

#undef  HAVE_C___ATOMIC
#define HAVE_C___ATOMIC 1

#undef  HAVE_THREAD_LS
#define HAVE_THREAD_LS

#undef  DEBUG_WOLFSSL
#define DEBUG_WOLFSSL

#undef  WOLFSSL_DEBUG_CODEPOINTS
#define WOLFSSL_DEBUG_CODEPOINTS

#undef  WOLFSSL_DEBUG_TRACE_ERROR_CODES
#define WOLFSSL_DEBUG_TRACE_ERROR_CODES

#undef  NO_DO178
#define NO_DO178

#undef  WOLFSSL_X86_64_BUILD
#define WOLFSSL_X86_64_BUILD

#undef  WOLFSSL_ASN_TEMPLATE
#define WOLFSSL_ASN_TEMPLATE

#undef  ERROR_QUEUE_PER_THREAD
#define ERROR_QUEUE_PER_THREAD

#undef  TFM_TIMING_RESISTANT
#define TFM_TIMING_RESISTANT

#undef  ECC_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT

#undef  WC_RSA_BLINDING
#define WC_RSA_BLINDING

#undef  WOLFSSL_ARMASM_NO_HW_CRYPTO
#define WOLFSSL_ARMASM_NO_HW_CRYPTO

#undef  WOLFSSL_USE_ALIGN
#define WOLFSSL_USE_ALIGN

#undef  WOLFSSL_SHA224
#define WOLFSSL_SHA224

#undef  WOLFSSL_SHA512
#define WOLFSSL_SHA512

#undef  WOLFSSL_SHA384
#define WOLFSSL_SHA384

#undef  HAVE_HKDF
#define HAVE_HKDF

#undef  HAVE_ECC
#define HAVE_ECC

#undef  ECC_SHAMIR
#define ECC_SHAMIR

#undef  ECC_MIN_KEY_SZ
#define ECC_MIN_KEY_SZ 224

#undef  HAVE_ECC_BRAINPOOL
#define HAVE_ECC_BRAINPOOL

#undef  HAVE_ECC_ENCRYPT
#define HAVE_ECC_ENCRYPT

#undef  NO_OLD_TLS
#define NO_OLD_TLS

#undef  WC_RSA_PSS
#define WC_RSA_PSS

#undef  WOLFSSL_PSS_LONG_SALT
#define WOLFSSL_PSS_LONG_SALT

#undef  WOLFSSL_ASN_PRINT
#define WOLFSSL_ASN_PRINT

#undef  WOLFSSL_BASE64_ENCODE
#define WOLFSSL_BASE64_ENCODE

#undef  WOLFSSL_CUSTOM_CURVES
#define WOLFSSL_CUSTOM_CURVES

#undef  HAVE_ECC_SECPR2
#define HAVE_ECC_SECPR2

#undef  HAVE_ECC_SECPR3
#define HAVE_ECC_SECPR3

#undef  HAVE_ECC_BRAINPOOL
#define HAVE_ECC_BRAINPOOL

#undef  HAVE_ECC_KOBLITZ
#define HAVE_ECC_KOBLITZ

#undef  HAVE_ECC_CDH
#define HAVE_ECC_CDH

#undef  WOLFSSL_SHA3
#define WOLFSSL_SHA3

#undef  WOLFSSL_NO_SHAKE128
#define WOLFSSL_NO_SHAKE128

#undef  WOLFSSL_NO_SHAKE256
#define WOLFSSL_NO_SHAKE256

#undef  HAVE_POLY1305
#define HAVE_POLY1305

#undef  HAVE_CHACHA
#define HAVE_CHACHA

#undef  HAVE_HASHDRBG
#define HAVE_HASHDRBG

#undef  HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS

#undef  HAVE_SNI
#define HAVE_SNI

#undef  HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS

#undef  HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES

#undef  HAVE_FFDHE_2048
#define HAVE_FFDHE_2048

#undef  HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES

#undef  WOLFSSL_TLS13
#define WOLFSSL_TLS13

#undef  HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS

#undef  HAVE_EXTENDED_MASTER
#define HAVE_EXTENDED_MASTER

#undef  HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS

#undef  HAVE_SNI
#define HAVE_SNI

#undef  HAVE_MAX_FRAGMENT
#define HAVE_MAX_FRAGMENT

#undef  HAVE_TRUNCATED_HMAC
#define HAVE_TRUNCATED_HMAC

#undef  HAVE_ALPN
#define HAVE_ALPN

#undef  HAVE_TRUSTED_CA
#define HAVE_TRUSTED_CA

#undef  HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES

#undef  NO_RC4
#define NO_RC4

#undef  HAVE_ENCRYPT_THEN_MAC
#define HAVE_ENCRYPT_THEN_MAC

#undef  NO_PSK
#define NO_PSK

#undef  NO_MD4
#define NO_MD4

#undef  WOLFSSL_ENCRYPTED_KEYS
#define WOLFSSL_ENCRYPTED_KEYS

#undef  HAVE_PKCS11
#define HAVE_PKCS11

#undef  HAVE_WOLF_BIGINT
#define HAVE_WOLF_BIGINT

#undef  WOLFSSL_SP_MATH_ALL
#define WOLFSSL_SP_MATH_ALL

#undef  WOLFSSL_SP_X86_64
#define WOLFSSL_SP_X86_64

#undef  WOLF_CRYPTO_CB
#define WOLF_CRYPTO_CB

#undef  WC_NO_ASYNC_THREADING
#define WC_NO_ASYNC_THREADING

#undef  HAVE_DH_DEFAULT_PARAMS
#define HAVE_DH_DEFAULT_PARAMS

#undef  HAVE_CURVE25519
#define HAVE_CURVE25519

#undef  HAVE_ED25519
#define HAVE_ED25519

#undef  WOLFSSL_SYS_CA_CERTS
#define WOLFSSL_SYS_CA_CERTS

#undef  OPENSSL_EXTRA
#define OPENSSL_EXTRA

#undef  NO_DES3
#define NO_DES3

#undef  NO_DES3_TLS_SUITES
#define NO_DES3_TLS_SUITES

#undef  GCM_TABLE_4BIT
#define GCM_TABLE_4BIT

#undef  HAVE_AESGCM
#define HAVE_AESGCM

#undef  WOLFSSL_AESGCM_STREAM
#define WOLFSSL_AESGCM_STREAM

#undef  HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS

#undef  HAVE_SERVER_RENEGOTIATION_INFO
#define HAVE_SERVER_RENEGOTIATION_INFO

#undef  HAVE___UINT128_T
#define HAVE___UINT128_T 1

#undef  HAVE_GETPID
#define HAVE_GETPID 1

#undef  HAVE_WC_INTROSPECTION
#define HAVE_WC_INTROSPECTION

#ifdef __cplusplus
}
#endif

#endif /* WOLFSSL_OPTIONS_H */