NRF9160 TLS and MQTT

[DenisAks]

Hello guys,

We are working on the project and using DK 9160. We want to use LTE Cat M1 connection, mqtt tls and we need full functionality embed tls. We started with demo based on the BSD_socket library and as we understood contains partly tls security solution. But when we tried to use mbed tls library ported to Zephyr we had issue with multiple definition. Could you please clarify is it possible to use both libraries (zephyr ebed tls and bsd socket ) in common project?

BR, Denis.

[jbrzozoski]

Do you want TLS for the MQTT connection or a different connection?

[DenisAks]

Now only for MQTT.

[jbrzozoski]

I have been able to do MQTT over TLS using a config option directly related to the Zephyr MQTT library.  In my prj.conf I have:

# MQTT
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y

I have no other TLS libraries (explicitly) enabled.  I think that MQTT_LIB_TLS may indirectly enable a TLS library, but I never reference or call it from any of my code directly.  My code was originally based on the mqtt_simple application which you can find here: https://github.com/NordicPlayground/fw-nrfconnect-nrf/tree/master/samples/nrf9160/mqtt_simple

Be aware that there are multiple MQTT libraries between the zephyr and nrf code trees, and some of them are near clones of each other that should hopefully be converging upstream soon.  The one I have used successfully is the one you can enable with that specific config option, with the source code located in zephyr/subsys/net/lib/mqtt_sock

[DenisAks]

I see that using CONFIG_MQTT_LIB_TLS define enable support TLS sockets in MQTT, but the TLS does not realize in MQTT library and you need use zephyr TLS library or Nordic BSD sockets lib.
I saw examples MQTT with tls from zephyr for other boards and they used mbedTLS library.

Are you sure that you used MQTT TLS connection?

[jbrzozoski]

Yes, i definitely had a TLS connection.

It requires more code changes than just turning on that one config.  I also had to change the configured port to 8883, and had to modify the client_init function like this: 

#if defined(CONFIG_MQTT_LIB_TLS)
   client->transport.type = MQTT_TRANSPORT_SECURE;
   client->transport.tls.config.peer_verify = 0;
   client->transport.tls.config.cipher_count = 0;
   client->transport.tls.config.cipher_list = NULL;
   client->transport.tls.config.sec_tag_count = 0;
   client->transport.tls.config.seg_tag_list = NULL;
   client->transport.tls.config.hostname = NULL;
#else
   client->transport.type = MQTT_TRANSPORT_NON_SECURE;
#endif