switch cloud endpoint from nordic aws to our own aws account

[Kai]

I am trying to make the nrf9160 device work with our own AWS IoT account.

The nrf9160 device succeeds to run mqtt_client_tls_connect(). Then it runs mqtt_client_tls_write() to send a MQTT CONNECT command. However it doesn't receive MQTT CONNACK.

To debug this problem, I'd like to check the TCP layer packets exchanged between the device and the AWS IoT cloud.

1) could you please tell me how to turn on the log for showing the TCP layer packets in the device? 

2) could you please share experience for how to turn on the log for showing the TCP layer packets in the AWS IoT cloud?

Best,

Kai

[Øyvind]

Hi Kai,

Have you changed the hostname and the nrf_cloud transport specific layers to match your own cloud settings? 

In addition, you need to provide the CA root, private, and public key via the nrf_inbuild_key API, similar to what is done here: https://github.com/NordicPlayground/fw-nrfconnect-nrf/blob/master/subsys/net/lib/nrf_cloud/src/nrf_cloud_transport.c#L354.

Note: use another sec_tag than the one used in nrf_cloud!

 

The nrf_inbuilt_key API must be called prior to the modem registration. This is how you can add this manually to the application:

Next, you need to add the following to your prj.conf: https://github.com/NordicPlayground/fw-nrfconnect-nrf/blob/master/samples/nrf9160/mqtt_simple/prj.conf#L12

Then implement a modem_configure function similar to this one: https://github.com/NordicPlayground/fw-nrfconnect-nrf/blob/master/samples/nrf9160/mqtt_simple/src/main.c#L300 

The process if you choose to use mqtt_simple as a template would require that you add TLS support to the main.c part. This can be done by changing this function:

https://github.com/NordicPlayground/fw-nrfconnect-nrf/blob/master/samples/nrf9160/mqtt_simple/src/main.c#L275

To append the function with a tls_config (similar to this one: https://github.com/NordicPlayground/fw-nrfconnect-nrf/blob/master/subsys/net/lib/nrf_cloud/src/nrf_cloud_transport.c#L331) and point to the "sec_tag" that has been written to the modem.

The function would then look something like this:

/**@brief Initialize the MQTT client structure
 */
static void client_init(struct mqtt_client *client)
{
	mqtt_client_init(client);

	broker_init();

	/* MQTT client configuration */
	client->broker = &broker;
	client->evt_cb = mqtt_evt_handler;
	client->client_id.utf8 = (u8_t *)CONFIG_MQTT_CLIENT_ID;
	client->client_id.size = strlen(CONFIG_MQTT_CLIENT_ID);
	client->password = NULL;
	client->user_name = NULL;
	client->protocol_version = MQTT_VERSION_3_1_1;

	/* MQTT buffers configuration */
	client->rx_buf = rx_buffer;
	client->rx_buf_size = sizeof(rx_buffer);
	client->tx_buf = tx_buffer;
	client->tx_buf_size = sizeof(tx_buffer);

	/* MQTT transport configuration */
#if defined(CONFIG_MQTT_LIB_TLS)
	client->transport.type = MQTT_TRANSPORT_SECURE;

	static sec_tag_t sec_tag_list[] = {MY_SEC_TAG};
	struct mqtt_sec_config *tls_config = &client->transport.tls.config;
	
	tls_config->peer_verify = 2;
	tls_config->cipher_list = NULL;
	tls_config->sec_tag_list = sec_tag_list;
	tls_config->sec_tag_count = ARRAY_SIZE(sec_tag_list);
	tls_config->hostname = CONFIG_MQTT_BROKER_HOSTNAME;

#else
	client->transport.type = MQTT_TRANSPORT_NON_SECURE;
#endif
}

1) could you please tell me how to turn on the log for showing the TCP layer packets in the device? 

This is not possible from the nRF9160. And as you are running TLS, the communication is encrypted.

2) could you please share experience for how to turn on the log for showing the TCP layer packets in the AWS IoT cloud?

 I do not have any experience with AWS IoT Cloud, I'm afraid.

Kind regards,
Oeyvind

[Kai]

Hi Oeyvind,

I use lte_ble_gateway as a template. I've made the following changes:

1) change the cloud host_name

2) provide the CA root, private, and public key via the nrf_inbuild_key API, similar to what is done here: https://github.com/NordicPlayground/fw-nrfconnect-nrf/blob/master/subsys/net/lib/nrf_cloud/src/nrf_cloud_transport.c#L354.

Note: use another sec_tag than the one used in nrf_cloud!

Is there anything else I miss?

Best,

Kai

[Kai]

it works. thank you Oyvind!

[Øyvind]

Good to hear!
Are you able to connect AWS and receive MQTT CONNACK as expected?

If you are happy with the result, please close this ticket.

Kind regards,
Oeyvind

[Kai]

I can connect AWS and receive MQTT CONNACK as expected.

However the cloud client ID has to be the one created by AWS. E.g., I need to add the following code in nrf_cloud_transport.c:

  #define NRF_CLOUD_CLIENT_ID "065301278048"

"065301278048" is the AWS created client ID.

If using the serial number obtained by AT command (AT+CGSN), it fails to connect AWS. 

I understand that the sample asset_tracker does use the serial number as the client ID to connect AWS. do you know how it works?

BTW, I don't see the button for closing case in my web page. I did close cases before, but now don't know how to do it :-(

Best,
Kai

[Kai]

Only the "private" case can be closed?

Kai

[Øyvind]

I'm sorry, in this case, mark as "verified answer".

-Oeyvind