Hello, New user here (new in the forum, new in wolfssl and also new in freeRTOS )

I am working on a FreeRTOS-based application that uses wolfSSL v4.5.0-stable as the TLS library.
The connection is to an MQTT server over port 8883 using TLS 1.2 with mutual authentication.

Setup:

OS: FreeRTOS 202212.01

Networking: coreMQTT v2.1.1 + coreMQTT Agent v1.2.0

TLS library: wolfSSL v4.5.0-stable

Environment: FreeRTOS Windows simulator (Visual Studio) — using wolfSSL with WOLFSSL_USER_IO and the standard FreeRTOS transport send/recv functions (TLS_FreeRTOS_send and TLS_FreeRTOS_recv).

Problem:

The handshake proceeds normally up to CertificateVerify.
From the debug log:

Trying RSA private key
Using RSA private key
wolfSSL Entering RsaSign
wolfSSL Using RSA PSS padding
wolfSSL Leaving RsaSign, return 0
wolfSSL Entering VerifyRsaSign
wolfSSL Using RSA PSS un-padding
wolfSSL Leaving VerifyRsaSign, return 0
Shrinking output buffer
wolfSSL Leaving SendCertificateVerify, return 0
sent: certificate verify
connect state: FIRST_REPLY_THIRD
growing output buffer
wolfSSL error occurred, error = -308
wolfSSL Entering SSL_shutdown()
wolfSSL Leaving SSL_shutdown(), return -1
wolfSSL Entering SSL_free
CTX ref count not 0 yet, no free
Shrinking output buffer

Packet capture (Wireshark) confirms the sequence:

Client sends Certificate, ClientKeyExchange, and CertificateVerify.

Immediately after, the client sends ChangeCipherSpec.

At this point, no Finished message is ever sent by the client.

The client closes the connection, resulting in wolfSSL error = -308.

What I tried:

Removed compile-time options WC_RSA_PSS and WC_RSA_NO_PADDING.

Verified that RSA key + CSR + certificate are valid (I can use them with Postman successfully against the same server).

Verified that ChangeCipherSpec is sent from the client, but no Finished follows.

Questions:

Has this behavior (client failing to send Finished after CertificateVerify in mutual TLS) been seen before in v4.5.0?

Were there fixes for this in later wolfSSL releases (4.6.0, 4.7.0, or newer)?

Could this be caused by a misconfiguration of compile-time flags? (See below.)

Build options (relevant subset):
#define WOLFSSL_TLS12
#define HAVE_TLS_EXTENSIONS
#define HAVE_SUPPORTED_CURVES
#define HAVE_FFDHE_2048
#define HAVE_AESGCM
#define HAVE_AESCCM
#define WOLFSSL_SHA384
#define WOLFSSL_SHA512
#define HAVE_HKDF
#define HAVE_ECC
#define TFM_ECC256
#define ECC_SHAMIR
#define WOLFSSL_KEY_GEN
#define HAVE_CERTGEN
#define WOLFSSL_CERT_REQ
#define DEBUG_WOLFSSL

Any guidance would be greatly appreciated — especially whether this is a known issue in 4.5.0 and if upgrading to a newer wolfSSL version should resolve it, or if my build configuration needs adjustment.

Thanks in advance,
Felipe.