OTA upload http issue - Arduino FINDER OPTA Wifi

manucast · March 1, 2025, 3:32pm

Hi all,

Sorry to disturb the community.
But I am in trouble w/ my OPTA Wifi module when I try to upload sketch from my https server

To help me, I use in my project the OTA upload from this tutorials :

https://docs.arduino.cc/tutorials/portenta-h7/over-the-air-update/

and

https://github.com/arduino-libraries/Arduino_Portenta_OTA/blob/main/examples/OTA_Qspi_Flash_Ethernet/OTA_Qspi_Flash_Ethernet.ino

All works well if and only if I use the download link from the tutorials. I mean :

https://downloads.arduino.cc/ota/OTA_Usage_Portenta.ino.OPTA.ota

As soon as I use my own link :

https://ota.ejc-solutions.com/OTA_Usage_Portenta.ino.OPTA.ota

an error -3011 is returned ! See the debug below :

16:12:44.332 -> Starting download to QSPI ...
16:12:45.112 -> Arduino_Portenta_OTA_QSPI::download failed with error code -3011

I tried in Ethernet or Wifi, same behavior, error -3011.
If I set false to is_https from ota.download function (int const ota_download = ota.download(OTA_FILE_LOCATION, false /* is_https */) the OPTA stays blocked to download :

15:41:34.228 -> Starting download to QSPI ...
and not more !

I know that I did a mistake w/ my https link, but where, I don't know. Because when I click on it, it works. The file can be uploaded.

I tried to find the -3011 error but unfortunately, I didn't find anything
I searched into the utility.cpp from the same tutorial but there is no explanation about this error code. Same situation from the web, I didn't find.

Please, if someone can help me, it will be w/ pleasure

manucast · March 1, 2025, 5:58pm

I forgot to precise that I tried an others links and always same pb. I think that it is a pb w/ http server but what, I don’t know

steve9 · March 1, 2025, 6:35pm

Hi @manucast

-3011 is NSAPI_ERROR_AUTH_FAILURE

github.com/ARMmbed/mbed-os

connectivity/netsocket/include/netsocket/nsapi_types.h

d723bf9e5


      
              NSAPI_ERROR_WOULD_BLOCK         = -3001,     /*!< no data is not available but call is non-blocking */
              NSAPI_ERROR_UNSUPPORTED         = -3002,     /*!< unsupported functionality */
              NSAPI_ERROR_PARAMETER           = -3003,     /*!< invalid configuration */
              NSAPI_ERROR_NO_CONNECTION       = -3004,     /*!< not connected to a network */
              NSAPI_ERROR_NO_SOCKET           = -3005,     /*!< socket not available for use */
              NSAPI_ERROR_NO_ADDRESS          = -3006,     /*!< IP address is not known */
              NSAPI_ERROR_NO_MEMORY           = -3007,     /*!< memory resource not available */
              NSAPI_ERROR_NO_SSID             = -3008,     /*!< ssid not found */
              NSAPI_ERROR_DNS_FAILURE         = -3009,     /*!< DNS failed to complete successfully */
              NSAPI_ERROR_DHCP_FAILURE        = -3010,     /*!< DHCP failed to complete successfully */
              NSAPI_ERROR_AUTH_FAILURE        = -3011,     /*!< connection to access point failed */
              NSAPI_ERROR_DEVICE_ERROR        = -3012,     /*!< failure interfacing with the network processor */
              NSAPI_ERROR_IN_PROGRESS         = -3013,     /*!< operation (eg connect) in progress */
              NSAPI_ERROR_ALREADY             = -3014,     /*!< operation (eg connect) already in progress */
              NSAPI_ERROR_IS_CONNECTED        = -3015,     /*!< socket is already connected */
              NSAPI_ERROR_CONNECTION_LOST     = -3016,     /*!< connection lost */
              NSAPI_ERROR_CONNECTION_TIMEOUT  = -3017,     /*!< connection timed out */
              NSAPI_ERROR_ADDRESS_IN_USE      = -3018,     /*!< Address already in use */
              NSAPI_ERROR_TIMEOUT             = -3019,     /*!< operation timed out */
              NSAPI_ERROR_BUSY                = -3020,     /*!< device is busy and cannot accept new operation */
          };

and is probably being thrown by the handshake

github.com/ARMmbed/mbed-os

connectivity/netsocket/include/netsocket/TLSSocketWrapper.h

d723bf9e5


      
               *  calling this function.
               *
               *  For non-blocking purposes, this functions needs to know whether this
               *  was a first call to Socket::connect() API so that NSAPI_ERROR_INPROGRESS
               *  does not happen twice.
               *
               *  @param        first_call is this a first call to Socket::connect() API.
               *  @retval       NSAPI_ERROR_OK if we happen to complete the request on the first call.
               *  @retval       NSAPI_ERROR_IN_PROGRESS if the first call did not complete the request.
               *  @retval       NSAPI_ERROR_NO_SOCKET in case the transport socket was not created correctly.
               *  @retval       NSAPI_ERROR_AUTH_FAILURE in case of tls-related authentication errors.
               *                See @ref mbedtls_ctr_drbg_seed or @ref mbedtls_hmac_drbg_seed, @ref mbedtls_ssl_setup. @ref mbedtls_ssl_handshake.
               */
              nsapi_error_t start_handshake(bool first_call);
          
              bool is_handshake_started() const;
          
              void event();
          #endif

These are the tests mbed devs run to validate the handshake code. I'd check your site against each of the tests that are expected to return -3011

github.com/ARMmbed/mbed-os

connectivity/netsocket/tests/TESTS/netsocket/tls/tlssocket_handshake_invalid.cpp

d723bf9e5


      
              SocketAddress address;
              nsapi_error_t result = net->gethostbyname("expired.badssl.com", &address);
              if (result != NSAPI_ERROR_OK) {
                  TEST_SKIP_MESSAGE(" badssl.com not supported IP6 AAA records");
              }
          #endif
              TLSSocket sock;
              TEST_ASSERT_EQUAL(NSAPI_ERROR_OK, sock.open(net));
              TEST_ASSERT_EQUAL(NSAPI_ERROR_OK, sock.set_root_ca_cert(tls_global::cert));
          
              SocketAddress a;
          
              TEST_ASSERT_EQUAL(NSAPI_ERROR_OK, net->gethostbyname("expired.badssl.com", &a));
              a.set_port(https_port);
              TEST_ASSERT_EQUAL(NSAPI_ERROR_AUTH_FAILURE, sock.connect(a));
          
              TEST_ASSERT_EQUAL(NSAPI_ERROR_OK, net->gethostbyname("wrong.host.badssl.com", &a));
              a.set_port(https_port);
              TEST_ASSERT_EQUAL(NSAPI_ERROR_AUTH_FAILURE, sock.connect(a));
          
              TEST_ASSERT_EQUAL(NSAPI_ERROR_OK, net->gethostbyname("self-signed.badssl.com", &a));

steve9 · March 1, 2025, 7:24pm

Just checked the cacert.pem installed on the GIGA (I suspect OPTA uses the same) and I can't see the cert authorities you've used for your site. (keytool output attached)
cacert.txt (55.7 KB)

manucast · March 1, 2025, 9:23pm

Many many thanks Steve9 to take your time to answer me.
Very appreciated
If I understand well (sorry but not familar w/ that), maybe, it is a pb w/ the SSL certificate.
I will regenerate it in case or and re-check it.
I will keep you the result.

steve9 · March 2, 2025, 7:26am

I believe the problem is that the root CA used by Let's Encrypt (ISRG Root X1) is not included in the Arduino supplied cacert.pem file. It is therefore considered untrusted and fails to connect. Arduino downloads uses a cert with Google Trust Services as root, which is included.
Options:

Use a certificate service whose root is already in the Arduino provided file
Ask Arduino to include your root CA in the file and have them reissue
Add your root CA to the .pem file yourself

p.s. this may also be of use ArduinoCore-mbed/libraries/STM32H747_System/examples/WiFiFirmwareUpdater/Readme.md at main · arduino/ArduinoCore-mbed · GitHub

Update: Just seen a commit from 2yrs ago that adds ISRG Root X1 (Let's Encrypt) to CAs. Add ISRG Root X1 (Let's Encrypt) to CAs · arduino/ArduinoCore-mbed@be09d4e · GitHub

Suggest you run the WiFiFirmwareUpdater sketch from STM32H747_System examples before anything else.

Update 2: Forget everything I've said! I've just tried to download the ota file from your site using the Arduino code and the response is:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>

I've run the same code for the Arduino site and I get a 96KB binary. I suspect a problem with site permissions but that's as far as my website knowledge goes.

As the server is saying 2.0, maybe check it is also configured for 1.x

manucast · March 2, 2025, 2:24pm

Many many thanks for your help

I just started updating the certificate.h from my own MemoryPartitionning.ino from your link above (Update 1).
Indeed, I modified the initial partionning by adding 2x new block device after wifi_data (always 1Mb) and ota_data (5Mo).

And now, it works . I mean error 3011 disappeared / solved
Therefore, Let's encryp is full compatible w/ Arduino. Good news !

But, and unfortunately there is a but, there is a pb w/ the lenght data uploaded. Not conform 199 bytes instead of 97861 bytes using the download.arduino.cc link.
See below the debug :

15:03:39.485 -> Attempting to connect to the network ...
15:03:39.485 -> Connected
15:03:39.485 -> Initializing OTA storage
15:03:39.485 -> OTA_FILE_LOCATION: https://ota.ejc-solutions.com/OTA_Usage_Portenta.ino.OPTA.ota
15:03:39.485 -> Starting download to QSPI ...
15:03:41.161 -> 199 bytes stored.
15:03:41.161 -> Decompressing LZSS compressed file ...
15:03:41.352 -> Arduino_Portenta_OTA_QSPI::decompress() failed with error code-5

Maybe, it is an issue from server saying 2.0 as you wrote. I will try to find how to downgrade it or make it compatible.

I will keep you the result.
Once again, thanks for your help.

steve9 · March 2, 2025, 2:43pm

Great news, good progress. If you add these few lines to your sketch you'll be able to see the QSPI Flash partitions on your PC and read the file it has downloaded.

#include <PluggableUSBMSD.h>
#include <QSPIFBlockDevice.h>
QSPIFBlockDevice root;
USBMSD MassStorage(&root);

manucast · March 2, 2025, 3:19pm

Good idea, thanks steve9

So, the result is OK (UPDATE.BIN present) from arduino web site and KO (empty) from my web site

Therefore, and clearly, there is always an issue w/ the upload file from my web site because the USB OTA partition is empy.

Here is the debug :

From downloads.arduino.cc
16:03:36.020 -> Attempting to connect to the network ...
16:03:43.854 -> Connected
16:03:43.854 -> Initializing OTA storage
16:03:43.854 -> OTA_FILE_LOCATION: https://downloads.arduino.cc/ota/OTA_Usage_Portenta.ino.OPTA.ota
16:03:43.854 -> Starting download to QSPI ...
16:03:50.924 -> 97861 bytes stored.
16:03:50.924 -> Decompressing LZSS compressed file ...
16:04:04.933 -> 125376 bytes decompressed.
16:04:04.933 -> Storing parameters for firmware update in bootloader accessible non-volatile memory ...
16:04:04.933 -> Performing a reset after which the bootloader will update the firmware.
16:04:04.933 -> Hint: Board LED will blink Red-Blue-Green.

Result w/ AccessFlashAsUSBDisk
USB(D:) : 4343WA1.BIN & cacert.pem
USB(E:) : UPDATE.BIN (125376 bytes)
USB(F:) : empty
USB(G:) : empty

From my ota.ejc-solutions.com
16:11:01.790 -> Attempting to connect to the network ...
16:11:08.777 -> Connected
16:11:08.777 -> Initializing OTA storage
16:11:08.777 -> OTA_FILE_LOCATION: https://ota.ejc-solutions.com/OTA_Usage_Portenta.ino.OPTA.ota
16:11:08.777 -> Starting download to QSPI ...
16:11:10.410 -> 199 bytes stored.
16:11:10.410 -> Decompressing LZSS compressed file ...
16:11:10.579 -> Arduino_Portenta_OTA_QSPI::decompress() failed with error code-5

Result w/ accessfalsh
USB(D:) : 4343WA1.BIN & cacert.pem
USB(E:) : empty !!!!!!
USB(F:) : empty
USB(G:) : empty

steve9 · March 2, 2025, 4:03pm

The ota.decompress is removing the downloaded file if it fails validation so comment out everything in the example setup() after Serial.println(" bytes stored.");

github.com/arduino-libraries/Arduino_Portenta_OTA

src/decompress/utility.cpp

main


      
          uint8_t crc_buf[128];
          
          feedWatchdog();
          
          /* Read the OTA header ... */
          fread(ota_header.buf, 1, sizeof(ota_header.buf), update_file);
          
          /* ... and check first length ... */
          if (ota_header.header.len != (update_file_size - sizeof(ota_header.header.len) - sizeof(ota_header.header.crc32))) {
            fclose(update_file);
            remove(UPDATE_FILE_NAME_LZSS);
            return static_cast<int>(Error::OtaHeaderLength);
          }
          
          feedWatchdog();
          
          /* ... and the CRC second ... rewind to start of CRC verified header ... */
          fseek(update_file, sizeof(ota_header.header.len) + sizeof(ota_header.header.crc32), SEEK_SET);
          /* ... initialize CRC ... */
          crc32 = 0xFFFFFFFF;
          /* ... and calculate over file ... */

manucast · March 2, 2025, 4:28pm

Sorry, I didn't know that the file was deleted after a decompress failed.

The result is an UPDATE.BIN.LZSS file present but w/ only 199 bytes instead of 97861 bytes.

I am searching how to modify the header (DOCTYPE) from my provider (OVH). And I don't find how to do

I will continue to search.
Many thanks for your help and time steve9

manucast · March 2, 2025, 4:41pm

A friend will share w/ me his file server in order to check if this issue is also present.
He works w/ an other provider. Maybe...

Adventure to follow but

manucast · March 2, 2025, 6:51pm

Pb solved

W/ my friend, we have compared our files servers.
To summarize, his files server worked well w/ ota.download.
In comparing our dashboard, there was only one difference. His firewall application is disabled, not in my side.
And after disabling my firewall application, it works in my side.

Once again, thanks for your help steve9

steve9 · March 2, 2025, 7:12pm

So glad it's working for you. Would be good to know what rule in the firewall config would be required to have it work with the firewall app running

manucast · March 2, 2025, 7:19pm

I agree w/ you because it is not normal to disable firewall in order to allow the download.
I will try to understand why this situation.a

Topic		Replies	Views
Arduino Opta OTA error during upload Opta	25	3216	February 14, 2024
Arduino GIGA R1, OTA updating Programming	0	58	June 28, 2026
OTA (WIFI) Firmware updates on Arduino Giga Uploading	16	219	May 13, 2026
Arduino_Portenta_OTA.h error codes? Programming	5	118	April 16, 2026
arduinoOTA upload to UNO R4 WiFi fails: "no upload port provided" IDE 2.x	21	304	September 28, 2025

OTA upload http issue - Arduino FINDER OPTA Wifi

Related topics