mbedTLS with support of TLS_1.3 STM32H743II

[Jonas_A]

Hi,

I'm using a STM32H743II.

The product will communicate to server using the LwIP (TCP Layer) + MbedTLS (SSL/TLS Layer), running over FreeRTOS environment.

We want to use the latest TLS protocol standard (TLS Version 1.3).

We are currently using MbedTLS version 3.6.1 which supports TLS1.3, but we can only get TLS 1.2 to work.

Are there any example projects where TLS 1.3 is used that we can use?

BR

Jonas

[Billy OWEN]

Hi @Jonas_A 

 

This post has been escalated to the ST Online Support Team for additional assistance.  We'll contact you directly.

 

Regards,

Billy

[Wood.Andy]

Did you get anywhere with this as I would like to do it - preferably without FreeRTOS.

 

Thanks

 

Andy.

 

[sergey23]

First of, make sure your server side supports TLS 1.3.
 

openssl s_client -connect example.com:443 -tls1_3 -servername example.com 

That you can do from the workstation:

Then, the client side. Enable TLS 1.3 in the mbedtls_config.h - the MBEDTLS_SSL_PROTO_TLS1_3 should drive it.
You can grab inspiration from the Esperssif’s config: https://github.com/espressif/esp-idf/blob/0276131402f5383545ce5fc74f71d548fe5f3ffc/components/mbedtls/port/include/mbedtls/esp_config.h#L1237

If you want to get TLS without RTOS, then you need to use TCP/IP stack that supports that. lwIP has 3 different interfaces: raw, netconn, and BSD sockets. Usually TLS support is implemented over BSD sockets API, which requires RTOS.

So another choice would be to use Mongoose, which can run in either RTOS or non-RTOS environment.
 

Here is a working baremetal example on STM32F4 :

https://github.com/cesanta/mongoose/tree/master/tutorials/stm32/nucleo-f429zi/minimal

Make sure you have GNU make and ARM GCC installed, then simply type "make build flash" in that directory. Attach serial console to see the board's IP address (it should take it from DHCP).

Once done, you can easily add TLS. Add keys, like here https://github.com/cesanta/mongoose/blob/53d2356472e4a475ef92425d6372c2c0e36b0e61/tutorials/http/http-restful-server/main.c#L34-L50
Then, add a TLS handshake: https://github.com/cesanta/mongoose/blob/53d2356472e4a475ef92425d6372c2c0e36b0e61/tutorials/http/http-restful-server/main.c#L55-L64
Then, add HTTPS listener: https://github.com/cesanta/mongoose/blob/53d2356472e4a475ef92425d6372c2c0e36b0e61/tutorials/http/http-restful-server/main.c#L98

And that's the way you should get it.

If you want to do the same under Cube MX, follow the ST KB article to integrate Mongoose into the CubeMX project: https://community.st.com/stm32-mcus-60/stm32h7-ethernet-with-mongoose-getting-started-guide-165096 and repeat the 3 steps above.