BG96 HTTP works but HTTPS does not work

Hello everyone

I am using a device with the BG96 chip on it.
I want to do httpget and post to a https site but I always get an error 701 (unknow error)
If I do a get request to a http site it works fine

Can someone give me som advice?

Kind regards
Lennert

Hi Lenner, what mobile network provider are you using? have you uploaded TLS cert to the modem?

Hi i am from belgium i am using the Proximus netork provider and i dont have uploaded TLS cert how do i do that I have nothing seen in the manuals about that

See https://www.quectel.com/UploadImage/Downlad/Quectel_BG96_SSL_AT_Commands_Manual_V1.0.pdf and https://www.quectel.com/UploadImage/Downlad/Quectel_BG96_FILE_AT_Commands_Manual_V1.1.pdf

You can use AT+QFUPL to upload a CA certificate to “RAM:cacert” and configure that file in the SSL context.

Or just configure the SSL context “seclevel” to 0, as that does not need a certificate.

Other reasons for failure could be the supported ciphersuites and SSL/TLS version, both in the server and in the client.

Try first a check with https://www.howsmyssl.com/s/api.html and see what the server reply is. That might give you some hints. I mean to do the request with your modem, not the browser. :wink:

1 Like

i have configured the seclevel to 0.
also i have tried the config to support all ssl versions and ciphersuites and also the specific ssl version and ciphersuite of my https server.
I always get error 701 (unkown error).

Hi Lennert,

You solve that problem ??

Because i am facing same problem, if you find any solution then share with us.

https://forums.quectel.com/t/getting-701-unknown-error-https-post-request/2627

Please share solution if any.

Thanks,
Hardik

Same problem faced here. Has anyone got this working yet? @Hardik_Pokar - I can’t see the forum post at the link you included in your comment so not sure if you got it working.

1 Like

Hi shughes,

I am facing same issue
Are you try with same command ?..

I am posting data via HTTPS using quectel EC20. i am giving command in below order.

  1. I am uploading all certificate to RAM.
    AT+QFUPL=“RAM:cacert.pem”,2166,10
    AT+QFUPL=“RAM:clientcert.pem”,2172,10
    AT+QFUPL=“RAM:clientkey.pem”,1730,10
  2. PDP Setting
    AT+QICSGP=1
    AT+QIACT=1
    AT+QIACT?
  3. SSL SettingAT+QSSLCFG=“sslversion”,1,4
    AT+QSSLCFG=“ciphersuite”,1,0XFFFF
    AT+QSSLCFG=“seclevel”,1,2
    AT+QSSLCFG=“cacert”,1,"RAM:cacert.pem
    AT+QSSLCFG=“clientcert”,1,“RAM:clientcert.pem”
    AT+QSSLCFG=“clientkey”,1,“RAM:clientkey.pem”
  4. HTTP Setting
    AT+QHTTPCFG=“sslctxid”,1
    AT+QHTTPCFG=“contextid”,1
    AT+QHTTPCFG=“requestheader”,1
    AT+QHTTPURL=37,80
    AT+QHTTPPOST=179,80,80
    +CME ERROR: 701

Here i am getting this error.
when i tried with ssl opening that time same error

     AT+QSSLOPEN=1,1,4,"***.********.**",443,0 
     ok

   **+QSSLOPEN: 4,550**

Hi Lennert,

Http error 701 means http connection fail ,

so ,pls check your network register status first .

pls send the below at to check:

at+cereg?;+cgreg?;+cops?;+qcsq;+qnwinfo

AT+QIACT?

for the response value ,pls refer to AT cmd doc of BG96 , thanks

Dear stephen,

I check all the network related command and it’s looking fine.

and 701 is not network error , it’s unknown error.

Thanks,
Hardik

1 Like

All our network connection state is fine too, as in the same session we can do HTTP POST to httpbin.org, PING and also do DNS lookups. It’s just the HTTPS we can’t do!

Tried on an EC21 we had to hand this morning, get different error (730), which means over the modems there’s a missing command or step somewhere which we’re not aware of. @Stephen.Li-Q Any pointers?

Dear shughes,

Error 730 Means you are not passing Certificate properly or your certificate is invalid ,

And also if you are passing certificate with uart then make sure you are adding \r\n after every line.

Thanks. I’ll take a look at this when back in the office on Monday.

To solve the problem, we increased the ciphers on our server to the following:
ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

This problem was caused by our server not having the ciphers that the BG96 wanted. Although our server had one cipher that was supposed to be available on the BG96, obviously it wasn’t working, and we would always get 701 whenever we tried to post or get from from our server using https. If you are getting this problem from a server you do not control, then I fear you are out of luck.

2 Likes

Conversing with another user it seems that the cipher, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, is not working on the BG96 and perhaps other modules as well. So if that is the only matching cipher, then you will get a 701. Adding other matching ciphers should solve the issue.

I just tried everything failed but the AT+QSSLCFG=“sni”,1,1
“sni” stands for Server Name Indication. Just enabled the sni and it got successfully connected.
This seems because of the virtual server hosted on the same machine and it’s used to verify the server certificate. See https://en.wikipedia.org/wiki/Server_Name_Indication

2 Likes

If you are getting “Server Not Found”, that means that the client could not find the responsible server to serve your request.
In your case, that’s a HTTPS-based application.

Verify the following:
Go to Control Panel\System and Security\Windows Firewall\Allowed Programs Verify that you have “Secure World Wide Web Service (HTTPS)” and “Domain, Home/Work, and Public” both checked.

If this doesn\t works, try:

  • Clear History/Cookie & Restart Browser, Clear Temp file as well.
    If clearing of History not work, Reinstall Google Chrome.

In Command Prompt add following commands

  • ipconfig /flushdns
  • ipconfig /release
  • ipconfig /renew
  • Reset TCP/IP. Type ‘netsh int ip rese’ code in command prompt and press Enter.

Cheers,
Jimmy Wick

So, i just bumped on this topic trying to solve the same issue and thanks to coolmitch I was able to successfully execute a GET request to a server that was giving the +CME ERROR: 701 previously.
You saved my day. Thank you very much!! :slight_smile:

Very helpful. Thanks!