LWM2M Bootstrap towards Leshan Server fails. ( leshan.eclipseprojects.io/ )

[mpavlovic0815]

Hello,

I am facing frequent issues with bootstrapping from a remote LWM2M Server towards the Leshan server.
I can see handshake failures reported from the Leshan server, even if the direct connect with the same credentials works.
Have you faced any issues last 2 weeks ?

Thanks!
Cheers,
MP

[sbernard31]

What do you call "the Leshan Server" ?
Is it the Leshan Server Sandbox available at : https://leshan.eclipseprojects.io/#/clients ?

Which kind of handshake failures did you face ?

[sbernard31]

Now you change the issue title, I get that you are using the sandbox.

So if you want more information about the handshake failure, I need a more data. Like a tcpdump/wireshark capture. (You maybe found a bug?)

[sbernard31]

By the way the sandbox is automatically restarted to update it (system updates or leshan updates) and so there is no guaranty it is always up. If you need a stable environment you should consider to host it yourself.

[mpavlovic0815]

Hi,
thanks for getting back. It is the : https://leshan.eclipseprojects.io/#/clients [23.97.187.154]

[sbernard31]

Does your device use X509 to authenticate itself ?

[mpavlovic0815]

No, just the configured Key.

[sbernard31]

You mean you are using PreSharedKey ?

[sbernard31]

I looked at all the sandbox logs of this month and so only handshake issue I see is about certificate
(I probably found a bug which prevent to connect to leshan sandbox using x509 : eclipse-californium/californium#1245) but nothing about PSK.

So If you can provide a wireshark/tcpdump capture :)

[mpavlovic0815]

8988228066700007078.zip

[sbernard31]

Ok, I just looked at it and your device uses only deprecated CBC block ciphers.

As this ciphers are not consider as safe enough we deactivate it by default.
I would not like to activate it on the sandbox as I would not encourage to use this ciphers.

But If you run the sandbox by yourself you can activate old cipher option with :

-oc                            activate support of old/deprecated cipher suites.

[sbernard31]

(I fixed the x509 issue : commit 25413f2)

Could we close this issue ?

[mpavlovic0815]

Thanks for Support.