{"action":"created","issue":{"url":"https://api.github.com/repos/nodemcu/nodemcu-firmware/issues/996","labels_url":"https://api.github.com/repos/nodemcu/nodemcu-firmware/issues/996/labels{/name}","comments_url":"https://api.github.com/repos/nodemcu/nodemcu-firmware/issues/996/comments","events_url":"https://api.github.com/repos/nodemcu/nodemcu-firmware/issues/996/events","html_url":"https://github.com/nodemcu/nodemcu-firmware/issues/996","id":130296097,"number":996,"title":"NodeMCU speaks TLS 1.1 instead of TLS 1.2","user":{"login":"trahloff","id":16914641,"avatar_url":"https://avatars.githubusercontent.com/u/16914641?v=3","gravatar_id":"","url":"https://api.github.com/users/trahloff","html_url":"https://github.com/trahloff","followers_url":"https://api.github.com/users/trahloff/followers","following_url":"https://api.github.com/users/trahloff/following{/other_user}","gists_url":"https://api.github.com/users/trahloff/gists{/gist_id}","starred_url":"https://api.github.com/users/trahloff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trahloff/subscriptions","organizations_url":"https://api.github.com/users/trahloff/orgs","repos_url":"https://api.github.com/users/trahloff/repos","events_url":"https://api.github.com/users/trahloff/events{/privacy}","received_events_url":"https://api.github.com/users/trahloff/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodemcu/nodemcu-firmware/labels/documentation","name":"documentation","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"marcelstoer","id":624195,"avatar_url":"https://avatars.githubusercontent.com/u/624195?v=3","gravatar_id":"","url":"https://api.github.com/users/marcelstoer","html_url":"https://github.com/marcelstoer","followers_url":"https://api.github.com/users/marcelstoer/followers","following_url":"https://api.github.com/users/marcelstoer/following{/other_user}","gists_url":"https://api.github.com/users/marcelstoer/gists{/gist_id}","starred_url":"https://api.github.com/users/marcelstoer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcelstoer/subscriptions","organizations_url":"https://api.github.com/users/marcelstoer/orgs","repos_url":"https://api.github.com/users/marcelstoer/repos","events_url":"https://api.github.com/users/marcelstoer/events{/privacy}","received_events_url":"https://api.github.com/users/marcelstoer/received_events","type":"User","site_admin":false},"milestone":null,"comments":9,"created_at":"2016-02-01T08:38:30Z","updated_at":"2016-02-01T16:22:48Z","closed_at":null,"body":"Some rejected handshakes from a MQTT broker indicated that the TLS implementation is wrong in some way.\r\nAfter a colleague of mine set up some test stands, doing several days of testing and analysing the results he comes to the conclusion that the NodeMCU speaks TLS 1.1. Let me show you the results:\r\n\r\n**This is the NodeMCU client hello:**\r\n\r\n0000   16 03 02 00 33 01 00 00 2f **_03 02_** 00 00 00 00 d0\r\n0010   b1 a1 3a 07 1c 1b 3e f2 fc 03 91 d6 18 b5 ae 5d\r\n0020   77 65 37 f5 07 10 45 d1 7e 1a ea 00 00 08 00 2f\r\n0030   00 35 00 05 00 04 01 00\r\n\r\n**The parsing of that:**\r\n\r\n16 -\t   SSL3_RT_HANDSHAKE (Is this right - ie a common SSL3 and TLS byte here?)\r\n03 02 - \t   version : 3.2\r\n00 33 - \t   length of record excluding 5 bytes of header\r\n01 - \t   SSL3_MT_CLIENT_HELLO\r\n00 00 2f - length of the following data\r\n03 02 -    TLS v1.1\r\n00 00 00 00 d0 b1 a1 3a 07 1c 1b 3e f2 fc 03 91d6 //-- ?.... - Random 16 bytes\r\n\r\n\r\n**A proper TLS 1.2 client hello looks like this:**\r\n\r\n0000   16 03 01 00 7e 01 00 00 7a **_03 03_** 56 ab 8e f3 59\r\n0010   bb 39 71 b4 9f d1 4c bc 39 f3 37 ca 8c bc f8 f4\r\n0020   d8 6f 40 4b cf a9 a4 48 62 c1 70 00 00 10 00 9c\r\n0030   c0 2f c0 2b 00 a2 00 9e c0 31 c0 2d 00 ff 01 00\r\n0040   00 41 00 0b 00 04 03 00 01 02 00 0a 00 08 00 06\r\n0050   00 19 00 18 00 17 00 23 00 00 00 0d 00 20 00 1e\r\n0060   06 01 06 02 06 03 05 01 05 02 05 03 04 01 04 02\r\n0070   04 03 03 01 03 02 03 03 02 01 02 02 02 03 00 0f\r\n0080   00 01 01\r\n(This packet was captured from a browser connecting to the same test stand with TLS 1.2)\r\n\r\n\r\nAfter enabling TLS 1.1 on the test stand the NodeMCU could publish without any problems.\r\nThis is based on reading the rfcs for tls 1.1 and 1.2."},"comment":{"url":"https://api.github.com/repos/nodemcu/nodemcu-firmware/issues/comments/178053308","html_url":"https://github.com/nodemcu/nodemcu-firmware/issues/996#issuecomment-178053308","issue_url":"https://api.github.com/repos/nodemcu/nodemcu-firmware/issues/996","id":178053308,"user":{"login":"trahloff","id":16914641,"avatar_url":"https://avatars.githubusercontent.com/u/16914641?v=3","gravatar_id":"","url":"https://api.github.com/users/trahloff","html_url":"https://github.com/trahloff","followers_url":"https://api.github.com/users/trahloff/followers","following_url":"https://api.github.com/users/trahloff/following{/other_user}","gists_url":"https://api.github.com/users/trahloff/gists{/gist_id}","starred_url":"https://api.github.com/users/trahloff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trahloff/subscriptions","organizations_url":"https://api.github.com/users/trahloff/orgs","repos_url":"https://api.github.com/users/trahloff/repos","events_url":"https://api.github.com/users/trahloff/events{/privacy}","received_events_url":"https://api.github.com/users/trahloff/received_events","type":"User","site_admin":false},"created_at":"2016-02-01T16:22:48Z","updated_at":"2016-02-01T16:22:48Z","body":"No but I wrote to Espressif (the \"feedback\" address) and they said:\r\n\r\n> Currently our SDK don't support TLS1.2, we plan to  update it next year."}}