lpac: OpenWRT libcurl & mbedtls not working with lpac

Maintainer: @blocktrron
Environment: ARM Cortex-A76, Raspberry Pi 5, OpenWRT Snapshot 5th Sept 2024

Description:

Problem

lpac relies on curl for HTTP operations, but the OpenWrt version of libcurl is compiled with mbedtls, which lacks certain features required for the necessary certificate reading and TLS handshake when provisioning eSIM profiles. Specifically, mbedtls on OpenWrt has difficulty reading the GSMA Root CA (which is signed with ecdsa-with-SHA256 ) and possibly does not support the necessary cryptography with the server (TLSv1.3 with TLS_AES_256_GCM_SHA384 ).

Due to these mbedtls limitations, curl on OpenWrt fails with errors like:

Error reading ca cert file gsmaroot.crt - mbedTLS: (-0x2080) X509 - Unavailable feature, e.g. RSA hashing/encryption combination

and:

SSL - Client received an extended server hello containing an unsupported extension during TLS handshakes

preventing successful eSIM profile provisioning.

Workaround

Recompiling libcurl with OpenSSL using OpenWrt's standard configuration, instead of mbedtls, resolves the cert reading and TLS handshake issues, allowing successful eSIM profile downloads and operations. However, given that mbedtls is the default OpenWrt library it would be good if possible to have it work with basic consumer esim operations with lpac.

No source files or tests are identified. Start by reproducing lpac's basic consumer eSIM operations on OpenWrt with its default mbedTLS-backed libcurl, then compare the certificate and TLS failures with the stated OpenSSL workaround. Done means provisioning succeeds without recompiling libcurl to use OpenSSL.