• Registered: 2022-08-15
  • Posts: 9

Topic: spontaneous connection refusal in wolfSSL_connect(ssl)

Since last Thursday, I have been experiencing an issue retrieving precipitation data from buienradar.nl. The configuration had been working without any problems for about 4 years. The system is now returning a -313 error, which, according to the documentation, appears to be a cipher suite error.

The strange thing is that the same code has continued to work with other sites used to retrieve electricity prices—for example, dataportal-api.nordpoolgroup.com and web-api.tp.entsoe.eu.

When I check which cipher suites are supported using: 

nmap --script ssl-enum-ciphers -p 443 gpsgadget.buienradar.nl

I find that they all support `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` (using the `ecdh_x25519` key exchange)—a fact I have verified for the connection to Nord Pool Group.

I have tried adding more cipher suites, but that does not seem to be where the problem lies. There is approximately 90kB of RAM available. I hope someone can tell me how to resolve this issue. The site itself seems to be working; in the browser, I receive the expected response at:
https://gpsgadget.buienradar.nl/data/ra … p;lon=5.17

The log shows:

17:13:47 wolfSSLlog: 2, wolfSSL Entering TLSv1_2_client_method_ex
17:13:47 wolfSSLlog: 2, wolfSSL Entering wolfSSL_new
17:13:47 wolfSSLlog: 2, wolfSSL Entering ReinitSSL
17:13:47 wolfSSLlog: 1, RNG_HEALTH_TEST_CHECK_SIZE = 128
17:13:47 wolfSSLlog: 1, sizeof(seedB_data)         = 128
17:13:47 wolfSSLlog: 2, wolfSSL Entering SetSSL_CTX
17:13:47 wolfSSLlog: 2, wolfSSL Entering wolfSSL_NewSession
17:13:47 wolfSSLlog: 1, InitSSL done. return 0 (success)
17:13:47 wolfSSLlog: 1, wolfSSL_new InitSSL success
17:13:47 wolfSSLlog: 3, wolfSSL Leaving wolfSSL_new InitSSL =, return 0
17:13:47 wolfSSLlog: 1, TLS 1.2 or lower
17:13:47 wolfSSLlog: 2, wolfSSL Entering wolfSSL_connect
17:13:47 wolfSSLlog: 2, wolfSSL Entering ReinitSSL
17:13:47 wolfSSLlog: 2, wolfSSL Entering SendClientHello
17:13:47 wolfSSLlog: 1, Adding signature algorithms extension
17:13:47 wolfSSLlog: 1, growing output buffer
17:13:47 wolfSSLlog: 1, Signature Algorithms extension to write
17:13:47 wolfSSLlog: 1, Point Formats extension to write
17:13:47 wolfSSLlog: 1, Supported Groups extension to write
17:13:47 wolfSSLlog: 1, SNI extension to write
17:13:47 wolfSSLlog: 1, Shrinking output buffer
17:13:47 wolfSSLlog: 3, wolfSSL Leaving SendClientHello, return 0
17:13:47 wolfSSLlog: 1, connect state: CLIENT_HELLO_SENT
17:13:47 wolfSSLlog: 1, Server state up to needed state.
17:13:47 wolfSSLlog: 1, Progressing server state...
17:13:47 wolfSSLlog: 1, ProcessReply...
17:13:47 wolfSSLlog: 1, received record layer msg
17:13:47 wolfSSLlog: 1, got ALERT!
17:13:47 wolfSSLlog: 1, Alert type: internal_error
17:13:47 wolfSSLlog: 0, wolfSSL error occurred, error = 80
17:13:47 wolfSSLlog: 0, wolfSSL error occurred, error = -313
17:13:47 ENTSO.ino: 518 ERROR: wolfSSL_connect failed
17:13:47 wolfSSLlog: 2, wolfSSL Entering wolfSSL_get_version
17:13:47 wolfSSLlog: 2, wolfSSL Entering wolfSSL_get_cipher
17:13:47 wolfSSLlog: 2, wolfSSL Entering wolfSSL_get_current_cipher
17:13:47 wolfSSLlog: 2, wolfSSL Entering wolfSSL_CIPHER_get_name
SSL version is TLSv1.2, SSL cipher suite is NONE

The code is executed on STM32 Blackpill, the IDE is Arduino. WolfSSL version is 5.9.4

The stripped used code is in the attachment.

Post's attachments

buienradar.txt 2.74 kb, 1 downloads since 2026-11-02 

You don't have the permssions to download the attachments of this post.

Share

  • Registered: 2021-07-06
  • Posts: 201

Re: spontaneous connection refusal in wolfSSL_connect(ssl)

Hi BerHav,

Looks like the server is sending an internal_error alert in response to your ClientHello.  This is most likely an issue with extensions.
Please try enabling the following extensions and let me know if it helps.  If you continue to run into issues, please attach your current build settings.

#define HAVE_EXTENDED_MASTER
#define HAVE_CURVE25519 // For x25519 in supported_groups
#define HAVE_ENCRYPT_THEN_MAC

Thanks,
Kareem

Share

  • Registered: 2022-08-15
  • Posts: 9

Re: spontaneous connection refusal in wolfSSL_connect(ssl)

Hi Kareem,

Thanks for your quick response. Unfortunately, the additional options did not lead to a solution. The log looks exactly the same after the new build.

Attached is the user_settings.h file that I am currently using.

Post's attachments

user_settings.h 1.41 kb, 1 downloads since 2026-11-02 

You don't have the permssions to download the attachments of this post.

Share

  • Registered: 2021-07-06
  • Posts: 201

Re: spontaneous connection refusal in wolfSSL_connect(ssl)

Hi BerHav,

Thanks for the followup and sorry to hear that didn't help.  I have a few more settings for you to try:
#define WOLFSSL_SHA384
#define WOLFSSL_SHA512
#define HAVE_RENEGOTIATION_INDICATION

I am observing that the server is choosing SHA384 when I connect to it here, so I suspect that is the setting you need.  But it is worth trying all of them.

Thanks,
Kareem

Share

  • Registered: 2022-08-15
  • Posts: 9

Re: spontaneous connection refusal in wolfSSL_connect(ssl)

Hi Kareem,

Thanks for your quick reply and the hints. There is still no change in the log file; the response remains the same. I have tried various combinations of build options—including all three at once—but the result remains unchanged. I also tested it using the default `user_settings.h` file from the distribution with this additions:

...... from top
/* Make sure this is not an ESP-IDF file */
#undef  WOLFSSL_ESPIDF

#define HAVE_ECC

/* == insertion BerHav == */
#define HAVE_CURVE25519 // For x25519 in supported_groups
#define HAVE_ENCRYPT_THEN_MAC
#define WOLFSSL_SHA384
#define WOLFSSL_SHA512
#define HAVE_RENEGOTIATION_INDICATION
#define WOLFSSL_TLS12
#define HAVE_TLS_EXTENSIONS
#define HAVE_SUPPORTED_CURVES
#define HAVE_EXTENDED_MASTER
#define HAVE_HKDF
#define WC_RSA_PSS
#define HAVE_AESGCM
#define HAVE_SNI
/* == end insertion BerHav == */
/* the rest of the file is unchanged /*

In every case, data retrieval from Nordpool works, but for Buienradar, I continue to get the same error message regardless of the configuration.
Attached the logfile from the connection and result from Nordpool and the failed connection to buienradar. Both uses the same routines to setup and read/write the connection.

Thanks,
Bert

Post's attachments

BerHav.log 37.34 kb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.

Share