How to enable TLS for MQTT on nRF5340

[Yanpengwu]

Hi Support team,

I'm currently using an nRF5340 DK and an ublox-SARA-R4 modem for MQTT communication, the Zephyr native MQTT lib was used. It can work well.
Now I want to enable TLS for the MQTT connection, and the root CA, client certificate and private key are generated.

Could you help give some guidance(sample or documentation) for the kconfig and steps of enabling TLS on MQTT? I'm using the net stack socket, not the offloaded socket.
There is a sample 'Secure MQTT Sensor/Actuator', but it can not be found in nRF SDK 2.5.2 and 2.6.1, where can I find the source code of this sample?
Thank you very much.

Best regards,
Yanpeng Wu

[AHaug]

Hi,

Here's a first suggestion to resources that might help (albeit it's from the WiFi academy course so it might not be relevant, but please have a look and see if the links are helpful for 5340 with TLS on MQTT): 

Process of enabling TLS on MQTT using the net stack socket:

1. Enable TLS support for the MQTT Library by enabling the following Kconfig `CONFIG_MQTT_LIB_TLS` https://academy.nordicsemi.com/courses/wi-fi-fundamentals/lessons/lesson-4-wifi-fundamentals/topic/mqtt-library/ 

CONFIG_MQTT_LIB_TLS

2. Set the transport type of the client to be secure. This is done in the `mqtt_transport` transport field in `struct mqtt_client`, by setting `transport.type` to `MQTT_TRANSPORT_SECURE` https://academy.nordicsemi.com/courses/wi-fi-fundamentals/lessons/lesson-4-wifi-fundamentals/topic/mqtt-library/ 

client_ctx.transport.type = MQTT_TRANSPORT_SECURE;

3. Define `struct mqtt_sec_config` and set the TLS configuration for the application. This includes the hostname for the MQTT broker, the security tags, and the preference for peer verification [source](academy.nordicsemi.com/.../).

struct mqtt_sec_config *tls_config = &client_ctx.transport.tls.config;
tls_config->peer_verify = TLS_PEER_VERIFY_REQUIRED;
tls_config->cipher_list = NULL;
tls_config->sec_tag_list = m_sec_tags;
tls_config->sec_tag_count = ARRAY_SIZE(m_sec_tags);
tls_config->hostname = MQTT_BROKER_HOSTNAME;

4. Before establishing the connection to the MQTT broker, write the certificate for the TLS connection to the device using the `tls_credential_add()` API call from the TLS credentials subsystem of the Zephyr socket API [source](academy.nordicsemi.com/.../).

5. You can also check and configure the following library Kconfig options specific to the MQTT helper library: `CONFIG_MQTT_HELPER_PORT` and `CONFIG_MQTT_HELPER_SEC_TAG` [source](docs.nordicsemi.com/.../description.html

For more detailed information, you can refer to the https://docs.nordicsemi.com/bundle/ncs-latest/page/zephyr/connectivity/networking/api/mqtt.html#using_mqtt_with_tls

Kind regards,
Andreas