AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE with 1.21.3 #551
Comments
twiking
added
bug
|
We have not seen any change in tls-related CI for aws-c-*, aws-crt-nodejs, or the SDK. Can you provide more information:
|
jmklix
added
response-requested
|
I'm using this example: https://github.com/aws/aws-iot-device-sdk-js-v2/blob/main/samples/node/pub_sub_mqtt5/index.ts |
github-actions
bot
removed
the
response-requested
The server is sending an alert in response to the initial client hello, and 70 is the protocol_version alert. Can you attach a wireshark pcap of the client hello packet? |
|
I have configured
If I change the security policy to TLS 1.2, it of course works. Do you want any other details from the |
|
I've created an internal ticket linked back to this issue. Oncall will dig in further when they have a chance. Just to verify: The issue only occurs when using a security policy that is TLS1.3 only. |
|
We've reproed this internally. The client hello sent out is dramatically different between 1.21.2 and 1.21.3 but I don't know why yet. In particular, in v1.21.3:
Given that the TLS13 only policy only supports those three missing cipher suites, it appears that (1) is the fundamental problem: https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.html#tls-policy-table I am going to make a release of the SDK that pins the CRT to exactly 1.21.2 until we figure out and correct the root cause. |
|
We have released the fix for TLS13. Please checkout the following releases. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
I'm using
aws-iot-device-sdk-v2which has a dependency toaws-crt.After reinstalling my project,
aws-iot-device-sdk-v2now installedaws-crt 1.21.3instead of1.21.2which was release last week. After this I'm started to getAWS_IO_TLS_ERROR_NEGOTIATION_FAILUREwhen connecting to AWS IoT Core withmqtt5. When I tried to install[email protected]again, it started to work again. So it looks like something got broken when updating the submodules in this release #547Expected Behavior
Connect to AWS IoT Core successfully
Current Behavior
Get
AWS_IO_TLS_ERROR_NEGOTIATION_FAILUREwhen trying to connectReproduction Steps
Connect to AWS IoT Core by using
mqtt5fromaws-iot-device-sdk-v2with a fresh npm install, to install latest version of[email protected].Possible Solution
No response
Additional Information/Context
No response
aws-crt-nodejs version used
1.21.3
nodejs version used
v20.14.0
Operating System and version
Debian
The text was updated successfully, but these errors were encountered: