TLS with mqtt

[mocasrhey]

As anyone been successful using TLS on mqtt?

[Thalhammer]

https://gist.github.com/Thalhammer/b60ccbe7d8777debd2ce43796791ce17

This is what I had as a not yet commited example. Not sure if it worked back than but it might be a good starting point.

[mocasrhey]

thanks! I will try it out, I'm trying to make it work with google cloud iot

[Wiz-IO]

https://cloud.google.com/iot/docs/how-tos/mqtt-bridge#using_a_long-term_mqtt_domain
Download long-term primary and backup for "mqtt.2030.ltsapis.goog"
https://pki.goog/gtsltsr/gtsltsr.crt
https://pki.goog/gsr4/GSR4.crt
Convert to PEMs

Store CA list - SSL_Store from PEMs[2]

CIPHER = "ECDHE-ECDSA-AES128-GCM-SHA256

sni_Name = mqtt.2030.ltsapis.goog

Create JVT mqtt.password from your google private key

If not have Qualcomm API bugs, MQTT will ok

[mocasrhey]

thank you! By JVT you mean JWT(JSON web token)?

[Wiz-IO]

yes, sorry
JWT
I use this:
https://github.com/GoogleCloudPlatform/google-cloud-iot-arduino/tree/master/src
Look at google git for C version

[mocasrhey]

Giving an update to the situation:

-Tried to connect to AWS cloud and wasn't successfull, converted the certificates with sharkssl and tried different combinations but nothing seems to work. The mqtt client connects but when it gets to the connect callback it gives "QAPI_NET_MQTT_CONNECT_FAILED_E", it looks like some sort of timeout operation happens.

-Tried with AT commands without success too.

Can't determine the causes, thought it was because of RTC not being up to date but concluded it's not, probably some bug with ssl and mqtt. So at this point im considering changing to another module.

[Wiz-IO]

that`s mean:

• key and cert files is wrong
• ssl config is wrong
• mqtt-client-id not exest
• Qualcomm ssl-mqtt ca_root bug...

Amazon-MQTT is very easy with ThreadX
https://www.linkedin.com/feed/update/urn:li:activity:6542386189587095552

[Thalhammer]

@mocasrhey How did you convert the certs ?

I might look into it but I never found the tool to convert the certs into the required format.

[Wiz-IO]

windows - 2 click - details - copy to file - export wizard .... to pem

[Thalhammer]

@Wiz-IO I know how to convert to pem, but the simcom modules use a different file format which is somehow property to their ssl stack.

[Wiz-IO]

AWS - MQTT
Amazon IoT Core - Manage
Create Thing and Certificates, download it and Activate
Policies Allow
Interact - get HTTPS URL for host name

module API
store KEY and CERT (from Amazon) to SSL store as QAPI_NET_SSL_CERTIFICATE_E and "filename"

MQTT SSL basic config....
for cert filename use filename from store
for ca_root file name use ..... string "empty" ... not NULL (workaround)

connect ... enjoy

ps: basic ( qapi ) format is pem (text)

[mocasrhey]

They use sharkssl, you need to convert the CA file to binary format, the client certificate and private key combine into one binary file too. I downloaded the tool here: https://realtimelogic.com/downloads/sharkssl/

you then go into the bin folder and you have the tools to do that.

[Wiz-IO]

https://github.com/Wiz-IO/framework-quectel/blob/master/threadx/bg96/SDK2/qapi/qapi_ssl.h#L456

[mocasrhey]

yes i noticed that too, i used that function too but still nothing

[Wiz-IO]

hints:
https://github.com/Wiz-IO/framework-quectel/blob/master/arduino/libraries/bg96/Ethernet/src/txMqtt.h

https://github.com/Wiz-IO/platformio-quectel-examples/blob/master/Arduino/bg96/bg96_amazon_mqtt/src/main.cpp