NRF9160 TLS and MQTT

RE: NRF9160 TLS and MQTT

Martin Lesund — Tue, 14 Apr 2020 09:29:31 GMT

Please check out the tutorial: https://devzone.nordicsemi.com/nordic/cellular-iot-guides/b/software-and-protocols/posts/enabling-and-testing-tls-in-mqtt_5f00_simple

If you have any issues please make a new case.

RE: NRF9160 TLS and MQTT

Shekhar Suthar — Mon, 13 Apr 2020 07:47:36 GMT

hello stevenlin

I'm working on same thing so I want to know that, Did you get success in that application because I'm not getting some issues in connection with Azure by certificates.

May be you can help me out

RE: NRF9160 TLS and MQTT

Martin Lesund — Mon, 07 Oct 2019 13:00:52 GMT

Hi Steven,

Please make a new thread

RE: NRF9160 TLS and MQTT

stevenlin — Sun, 22 Sep 2019 12:04:02 GMT

hi all,

i have same issue about it .

now , i ref https://github.com/joakimtoe/fw-nrfconnect-nrf/commit/36532a8ca60bf7139a988b5cbb4e6cb47948a9fa

add tls mqtt . it can't connect broker. (that return -45)

SPM: NS image at 0xc000
SPM: NS MSP at 0x20025bc0
SPM: NS reset vector at 0xe56d
SPM: prepare to jump to Non-Secure image.
***** Booting Zephyr OS build v1.14.99-ncs3-snapshot2-1266-g8711cfd5d348 *****
The MQTT simple sample started
nrf_inbuilt_key_delete(16842753, 0) => result=0
nrf_inbuilt_key_delete(16842753, 1) => result=0
nrf_inbuilt_key_delete(16842753, 2) => result=0
nrf_inbuilt_key_write => result=0
nrf_inbuilt_key_write => result=0
nrf_inbuilt_key_write => result=0
LTE Link Connecting ...
LTE Link Connected!
IPv4 Address found 5.196.95.208
ERROR: mqtt_connect -45

main.c

#include "nrf_inbuilt_key.h"


//#if !defined(CONFIG_USE_PROVISIONED_CERTIFICATES)
#include "certificates.h"
//#endif


#define CONFIG_CLOUD_CERT_SEC_TAG 16842753
static int provision_certificates(void)
{
	{
		int err;

		/* Delete certificates */
		nrf_sec_tag_t sec_tag = CONFIG_CLOUD_CERT_SEC_TAG;

		for (nrf_key_mgnt_cred_type_t type = 0; type < 3; type++) {
			err = nrf_inbuilt_key_delete(sec_tag, type);
			printk("nrf_inbuilt_key_delete(%u, %d) => result=%d\n",
				sec_tag, type, err);
		}

		/* Provision CA Certificate. */
		err = nrf_inbuilt_key_write(CONFIG_CLOUD_CERT_SEC_TAG,
					NRF_KEY_MGMT_CRED_TYPE_CA_CHAIN,
					CLOUD_CA_CERTIFICATE,
					strlen(CLOUD_CA_CERTIFICATE));
		printk("nrf_inbuilt_key_write => result=%d\n", err);
		if (err) {
			printk("CLOUD_CA_CERTIFICATE err: %d", err);
			return err;
		}

		/* Provision Private Certificate. */
		err = nrf_inbuilt_key_write(
			CONFIG_CLOUD_CERT_SEC_TAG,
			NRF_KEY_MGMT_CRED_TYPE_PRIVATE_CERT,
			CLOUD_CLIENT_PRIVATE_KEY,
			strlen(CLOUD_CLIENT_PRIVATE_KEY));
		printk("nrf_inbuilt_key_write => result=%d\n", err);
		if (err) {
			printk("NRF_CLOUD_CLIENT_PRIVATE_KEY err: %d", err);
			return err;
		}

		/* Provision Public Certificate. */
		err = nrf_inbuilt_key_write(
			CONFIG_CLOUD_CERT_SEC_TAG,
			NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT,
				 CLOUD_CLIENT_PUBLIC_CERTIFICATE,
				 strlen(CLOUD_CLIENT_PUBLIC_CERTIFICATE));
		printk("nrf_inbuilt_key_write => result=%d\n", err);
		if (err) {
			printk("CLOUD_CLIENT_PUBLIC_CERTIFICATE err: %d",
				err);
			return err;
		}
	}
	return 0;
}

/**@brief Initialize the file descriptor structure used by poll.
 */
static int fds_init(struct mqtt_client *c)
{

    fds.fd = c->transport.tls.sock;

	fds.events = POLLIN;

	return 0;
}


void main(void)
{
	int err;

	printk("The MQTT simple sample started\n");
	provision_certificates();
	modem_configure();

	client_init(&client);

	err = mqtt_connect(&client);
	if (err != 0) {
		printk("ERROR: mqtt_connect %d\n", err);
		return;
	}

	err = fds_init(&client);
	if (err != 0) {
		printk("ERROR: fds_init %d\n", err);
		return;
	}
...
}

certificates.h

#define CLOUD_CLIENT_PRIVATE_KEY \
"-----BEGIN RSA PRIVATE KEY-----\n" \
  "MIIEogIBAAKCAQEArjslJVMR6y7OQf+diPBE546zw9HO3pSxIbC1rN5R/w8mmoHi\n"\
  .....
2kYGR4ow8bWDL3xmThnmCyIRV7bJNqKvzU3U9hArV8=\n"\
"-----END RSA PRIVATE KEY-----\n"

#define CLOUD_CLIENT_PUBLIC_CERTIFICATE \
"-----BEGIN PUBLIC KEY-----\n" \
  "MIIC7zCCAligAwIBAgIBADANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UEBhMCR0Ix\n"\
  "FzAVBgNVBAgMDlVuaXRlZCBLaW5nZG9tMQ4wDAYDVQQHDAVEZXJieTESMBAGA1UE\n"\
.....
  "mgb7Y/aMXqTsICCzkL8qzEDb2VQGZU0Gd/LScR6Za1oeA7s=\n"\
"-----END PUBLIC KEY-----\n"

#define CLOUD_CA_CERTIFICATE \
"-----BEGIN CERTIFICATE-----\n" \
  "MIIC8DCCAlmgAwIBAgIJAOD63PlXjJi8MA0GCSqGSIb3DQEBBQUAMIGQMQswCQYD\n"\
 ....
  "1ZgKJc2zbSQ9fCPxt2W3mdVav66c6fsb7els2W2Iz7gERJSX\n"\
"-----END CERTIFICATE-----\n"

RE: NRF9160 TLS and MQTT

jbrzozoski — Tue, 19 Mar 2019 17:07:49 GMT

Yes, i definitely had a TLS connection.

It requires more code changes than just turning on that one config. I also had to change the configured port to 8883, and had to modify the client_init function like this:

#if defined(CONFIG_MQTT_LIB_TLS)
   client->transport.type = MQTT_TRANSPORT_SECURE;
   client->transport.tls.config.peer_verify = 0;
   client->transport.tls.config.cipher_count = 0;
   client->transport.tls.config.cipher_list = NULL;
   client->transport.tls.config.sec_tag_count = 0;
   client->transport.tls.config.seg_tag_list = NULL;
   client->transport.tls.config.hostname = NULL;
#else
   client->transport.type = MQTT_TRANSPORT_NON_SECURE;
#endif

RE: NRF9160 TLS and MQTT

DenisAks — Tue, 19 Mar 2019 14:44:35 GMT

I see that using CONFIG_MQTT_LIB_TLS define enable support TLS sockets in MQTT, but the TLS does not realize in MQTT library and you need use zephyr TLS library or Nordic BSD sockets lib.
I saw examples MQTT with tls from zephyr for other boards and they used mbedTLS library.

Are you sure that you used MQTT TLS connection?

RE: NRF9160 TLS and MQTT

jbrzozoski — Mon, 18 Mar 2019 13:57:21 GMT

I have been able to do MQTT over TLS using a config option directly related to the Zephyr MQTT library. In my prj.conf I have:

# MQTT
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y

I have no other TLS libraries (explicitly) enabled. I think that MQTT_LIB_TLS may indirectly enable a TLS library, but I never reference or call it from any of my code directly. My code was originally based on the mqtt_simple application which you can find here: https://github.com/NordicPlayground/fw-nrfconnect-nrf/tree/master/samples/nrf9160/mqtt_simple

Be aware that there are multiple MQTT libraries between the zephyr and nrf code trees, and some of them are near clones of each other that should hopefully be converging upstream soon. The one I have used successfully is the one you can enable with that specific config option, with the source code located in zephyr/subsys/net/lib/mqtt_sock

RE: NRF9160 TLS and MQTT

DenisAks — Mon, 18 Mar 2019 08:15:23 GMT

Now only for MQTT.

RE: NRF9160 TLS and MQTT

jbrzozoski — Fri, 15 Mar 2019 20:36:27 GMT

Do you want TLS for the MQTT connection or a different connection?