# Morse Micro CMSIS Pack 1.9.0 mbedTLS fork writes wrong record version on ChangeCipherSpec / Finished (TLS 1.2)

**URL:** <https://community.morsemicro.com/t/morse-micro-cmsis-pack-1-9-0-mbedtls-fork-writes-wrong-record-version-on-changecipherspec-finished-tls-1-2/2054>\
**Category:** Embedded\
**Created:** [September 23, 2026, 6:03pm UTC](https://community.morsemicro.com/t/morse-micro-cmsis-pack-1-9-0-mbedtls-fork-writes-wrong-record-version-on-changecipherspec-finished-tls-1-2/2054 "2026-09-23T18:03:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rohit\_Anandakumar](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@Rohit\_Anandakumar](https://community.morsemicro.com/u/Rohit_Anandakumar)\
**Post date:** [September 23, 2026, 6:03pm UTC](https://community.morsemicro.com/t/morse-micro-cmsis-pack-1-9-0-mbedtls-fork-writes-wrong-record-version-on-changecipherspec-finished-tls-1-2/2054/1 "2026-09-23T18:03:49Z")

</div>

Hi,

On the Morse Micro CMSIS Pack 1.9.0 of mbedTLS (v3.6.x), an outbound TLS 1.2 handshake completes correctly up through **ServerHelloDone** , but the subsequent **ChangeCipherSpec** and Finished records are emitted with the SSL 3.0 wire version (03 00) instead of TLS 1.2 (03 03). Strict clients (OpenSSL s\_client, Python ssl) reject this with fatal protocol\_version / **WRONG\_VERSION\_NUMBER** and abort.

The root cause is that ssl-\>tls\_version is clobbered to 0x0300 between the CCS state and the Finished state — almost certainly due to the fork’s **badmac\_seen\_or\_in\_hsfraglen** union member aliasing a neighboring field in **mbedtls\_ssl\_context**.

#### Debug evidence:

```auto
output record: msgtype = 20, version = [3:3], msglen = zu
0000: 14 03 03 00 01 01 <-- CCS correct

output record: msgtype = 22, version = [3:0], msglen = zu
0000: 16 03 00 00 28 ... <-- Finished WRONG

```

#### Client sees:

`SSL routines:tls_validate_record_header:wrong version number`

**Where it goes wrong:** `library/ssl_msg.c`, `mbedtls_ssl_write_record()`:

```auto
mbedtls_ssl_protocol_version tls_ver = ssl->tls_version; // <-- 0x0300 here
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
    if (tls_ver == MBEDTLS_SSL_VERSION_TLS1_3) {
        tls_ver = MBEDTLS_SSL_VERSION_TLS1_2;
    }
#endif
mbedtls_ssl_write_version(ssl->out_hdr + 1, ssl->conf->transport, tls_ver);

```

I did a small patch which made things work:

```auto
mbedtls_ssl_protocol_version tls_ver = ssl->tls_version;
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
    if (tls_ver == MBEDTLS_SSL_VERSION_TLS1_3) {
        tls_ver = MBEDTLS_SSL_VERSION_TLS1_2;
    }
#endif

    /* Force the TLS 1.2 wire version. The fork clobbers ssl->tls_version
     * to 0x0300 on the CCS -> Finished transition, causing strict clients
     * to abort with a fatal protocol_version alert. */
    if (tls_ver != MBEDTLS_SSL_VERSION_TLS1_2) {
        tls_ver = MBEDTLS_SSL_VERSION_TLS1_2;
    }

mbedtls_ssl_write_version(ssl->out_hdr + 1, ssl->conf->transport, tls_ver);

```

I hope this doesn’t affect is anything uses this and this is patched in next cmsis version.

---

<div class="post-metadata">

**Author:** ![adodd](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@adodd](https://community.morsemicro.com/u/adodd)\
**Post date:** [September 29, 2026, 2:07am UTC](https://community.morsemicro.com/t/morse-micro-cmsis-pack-1-9-0-mbedtls-fork-writes-wrong-record-version-on-changecipherspec-finished-tls-1-2/2054/2 "2026-09-29T02:07:51Z")

</div>

Hi @Rohit_Anandakumar ,

Thanks for the details, we think there are a few possible causes.

1. CMSIS-Pack 1.9.0 incorporated the MM-IoT-SDK 2.11.2, which had an upstep of mbedTLS from 3.6.2 to 3.6.5. So it is perhaps this change that is causing the issue (CMSIS passes through the SDK’s version of mbedTLS).
2. As you mention, the problem could be that a neighbouring field is clobbering the `tls_version`.
3. It could also be that the `tls_version` is being updated from an offset value (for example, the memory looks like `0x00,03,03,00` and the read from this memory is off by one).

We will look into this, but it would be helpful to know where you are starting from. Could you tell us:

1. What your `mbedtls_config.h` is?
2. Which example your are running (is it the sslclient example?)?
3. What additional build defines you might be using?
4. The details of how you’re testing the SSL 1.2 connection?

Also, if you have the time, could you see if the same behaviour exists in CMSIS 1.8?

Thanks again,

Andrew