How to use MQTT+TLS in nRF9160?

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Fri, 28 Jun 2019 12:40:40 GMT

OK. Finally I solved this issue, but I don't really understand what's going on. Basically I started over nrf9160 setting following Get Started Assisstant.

1. Update library: brew upgrade

2. Choose ncs_tag of v1.0.0-rc3

3. Copy the original prj.conf file, open MQTT+TLS project by "Open nRF Connect SDK Project", and rebuild it instead of build.

4. Copy the prj.conf file that KentaM shows above. Change url and client id according to your AWS IoT core setting. Set a certificates.h in src folder. Modify main.c

5. Open MQTT+TLS project again by "Open nRF Connect SDK Project", and rebuild it instead of build.

6. Connect J-Link and download the built Intel hex file to DK board util you don't see timeout error. It often causes timeout error in downloading.

7. Push reset button.

Thank you so much, KentaM!!

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Wed, 26 Jun 2019 16:42:22 GMT

@Hakon

I can't solve the above issue yet.
I tried a project, which KentaM uses successfully, with two different 0.8.2 DK boards, and they throw the same error. He gave me the whole project files including certificates.h through private message and I used it. The project should be the exactly same.

During nrf_inbuilt_key_delete, the project throws an error(14), "Bad Address."

SPM: NS image at 0x8000
SPM: NS MSP at 0x200240d8
SPM: NS reset vector at 0xb609
SPM: prepare to jump to Non-Secure image.
***** Booting Zephyr OS v1.14.99-ncs1 *****
The MQTT simple sample started
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 0) => result=2
Deleting certs sec_tag: 16842753
***** BUS FAULT *****
  Precise data bus error
  BFAR Address: 0x2800460d
***** Hardware exception *****
Current thread ID = 0x200203fc
Faulting instruction address = 0x1682c
Fatal fault in thread 0x200203fc! Aborting.
nrf_inbuilt_key_delete(16842753, 1) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 2) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 3) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 4) => result=14
Write ca certs sec_tag: 16842753
CA_CERTIFICATE err: 14
LTE Link Connecting ...
LTE Link Connected!
ERROR: getaddrinfo failed 22
ERROR: mqtt_connect -47

I'm sure the firmware is the latest one, 0.7.0-29.alpha.
ncs_tag is v0.4.0

mqtt_simple project which doesn't include TLS works fine. However, when it includes TLS procedure, it throws the error.

Any help?

RE: How to use MQTT+TLS in nRF9160?

Kenta — Tue, 18 Jun 2019 15:12:21 GMT

prj.conf

# General config
CONFIG_TEST_RANDOM_GENERATOR=y

# Networking
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS_OFFLOAD=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y

# LTE link control
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=n

# BSD library
CONFIG_BSD_LIBRARY=y

# AT Host
CONFIG_UART_INTERRUPT_DRIVEN=y
CONFIG_AT_HOST_LIBRARY=y
#CONFIG_SPM=n

# MQTT
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y

# Appliaction
#CONFIG_MQTT_PUB_TOPIC="/my/publish/topic"
#CONFIG_MQTT_SUB_TOPIC="/my/subscribe/topic"
#CONFIG_MQTT_CLIENT_ID="my-client-id"
#CONFIG_MQTT_BROKER_HOSTNAME="iot.eclipse.org"
#CONFIG_MQTT_BROKER_PORT=1883

CONFIG_MQTT_PUB_TOPIC="myTopic/publish"
CONFIG_MQTT_SUB_TOPIC="myTopic/subscribe"
CONFIG_MQTT_CLIENT_ID="nRF9160-DK"
CONFIG_MQTT_BROKER_HOSTNAME="a544w27l82h92-ats.iot.us-east-1.amazonaws.com"
CONFIG_MQTT_BROKER_PORT=8883

CONFIG_SEC_TAG=16842753

CONFIG_PROVISION_CERTIFICATES=y
CONFIG_CERTIFICATES_FILE="certificates.h"

# Main thread
CONFIG_MAIN_THREAD_PRIORITY=7
CONFIG_MAIN_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=1024

CONFIG_NO_OPTIMIZATIONS=y

By the way, I will do a study session, will you come?
Saturday.

atnd.org/.../106150

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Tue, 18 Jun 2019 13:59:12 GMT

About certificates, I downloaded three files from AWS IoT
- Amazon_Root_CA_1.pem(ca crt)
- xxxxxx-certificate.pem.crt(client crt, not public key)
- yyyyyy-private.pem.key(client private key)

I overwrote certificates.h put in src folder according to them.

The following message indicates that deleting the builtin certificate files was not successful. So I don't think AWS certificate files are related to this issue.

nrf_inbuilt_key_delete(16842753, 1) => result=14

Could you show me the content of the prj.conf again if possible? mqtt_simple prj.conf sets a value in CONFIG_SEC_TAG while mqtt_simple_tls project prj.conf sets a value in CONFIG_MQTT_TLS_SEC_TAG.

RE: How to use MQTT+TLS in nRF9160?

Kenta — Tue, 18 Jun 2019 12:57:17 GMT

I used GitHub's prj.conf, which Hakon taught me, almost as it is.

It looks like an error with CA_CERTIFICATE, but is the CA certificate correct?

https://github.com/joakimtoe/fw-nrfconnect-nrf/blob/36532a8ca60bf7139a988b5cbb4e6cb47948a9fa/samples/nrf9160/mqtt_simple_tls/prj.conf

By the way, I do not understand the meaning of CONFIG_SEC_TAG ... (tell me ...)

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Tue, 18 Jun 2019 12:31:06 GMT

Hello, KentaM!

CONFIG_SEC_TAG may be wrong value so that the error may be caused. How do you decide the value? random value?

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Tue, 18 Jun 2019 11:06:25 GMT

I tried AWS IoT but I'm still stucked...

I copied your code above based on mqtt_simple project and then changed MQTT_BROKER_HOSTNAME and MQTT_CLIENT_ID both in Kconfig and prj.conf. I attached certificates.h in src folder, which I downloaded from AWS.

I can't solve the problem below....

SPM: NS image at 0x8000
SPM: NS MSP at 0x200240d8
SPM: NS reset vector at 0xb609
SPM: prepare to jump to Non-Secure image.
***** Booting Zephyr OS v1.14.99-ncs1 *****
The MQTT simple sample started
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 0) => result=2
Deleting certs sec_tag: 16842753
***** BUS FAULT *****
  Precise data bus error
  BFAR Address: 0x2800460d
***** Hardware exception *****
Current thread ID = 0x200203fc
Faulting instruction address = 0x1682c
Fatal fault in thread 0x200203fc! Aborting.
nrf_inbuilt_key_delete(16842753, 1) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 2) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 3) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 4) => result=14
Write ca certs sec_tag: 16842753
CA_CERTIFICATE err: 14
LTE Link Connecting ...
LTE Link Connected!
ERROR: getaddrinfo failed 22
ERROR: mqtt_connect -47

- hardware: nRF9160 DK 0.8.2
- firmware: 0.7.0-29.alpha
- nrf ver: 0.4.0

RE: How to use MQTT+TLS in nRF9160?

Kenta — Mon, 17 Jun 2019 13:59:51 GMT

nrf9160_pca10090ns <-

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Mon, 17 Jun 2019 13:49:36 GMT

I see. I'll try AWS IoT Core. BTW, Which do you select in Board Name, nrf9160_pca10090ns or nrf9160_pca10090? Since mqtt_simple works with nrf9160_pca10090ns, I choose nrf9160_pca10090ns when implementing TLS.

RE: How to use MQTT+TLS in nRF9160?

Kenta — Mon, 17 Jun 2019 13:12:55 GMT

Ah....

I use AWS IoT Core without using EC2.

Because it costs a lot for EC2 instances.

If the MQTT_MESSAGE_BUFFER_SIZE is too long it will result in a BUS FAULT error.

日本語でも書いておくと、EC2インスタンスではなく、AWS IoT Coreを使っています。

EC2インスタンスだとお金いっぱいかかるので。

AWS IoT Coreでエッジデバイスを登録して、証明書とポリシーを設定及びアタッチしてあります。

BUS FAULTのエラーはMQTT_MESSAGE_BUFFER_SIZEが長すぎるとエラーになったように思います。

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Mon, 17 Jun 2019 12:42:07 GMT

Hi, KentaM. Thanks a lot!!

I'm still in trouble. This is the console print.

SPM: NS image at 0x8000
SPM: NS MSP at 0x200240f0
SPM: NS reset vector at 0xb811
SPM: prepare to jump to Non-Secure image.
***** Booting Zephyr OS v1.14.99-ncs1 *****
The MQTT simple sample started
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 0) => result=2
Deleting certs sec_tag: 16842753
***** BUS FAULT *****
  Precise data bus error
  BFAR Address: 0x3b61bb53
***** Hardware exception *****
Current thread ID = 0x20020410
Faulting instruction address = 0x16ad8
Fatal fault in thread 0x20020410! Aborting.
nrf_inbuilt_key_delete(16842753, 1) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 2) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 3) => result=14
Deleting certs sec_tag: 16842753
nrf_inbuilt_key_delete(16842753, 4) => result=14
Write ca certs sec_tag: 16842753
CA_CERTIFICATE err: 14
LTE Link Connecting ...
LTE Link Connected!
ERROR: getaddrinfo failed 22
ERROR: mqtt_connect -47

This may tell me that certification files are wrong, but MQTT+TLS works fine with another MQTT client with the same three files(CLIENT_PRIVATE_KEY, CLIENT_PUBLIC_CERTIFICATE, CA_CERTIFICATE). These files are self signed and generated by openssl.

In my case, I don't use AWS IoT service. I implemented mosquitto MQTT broker on EC2.

Do you have any comment?

<certificates.h> *under the src folder

#define CLIENT_ID "myClientID"

#define CLIENT_PRIVATE_KEY \
"-----BEGIN RSA PRIVATE KEY-----\n" \
"MIIEowIBAAKCAQEAyoE5FG1Hf9DFEA1iF9enHtxNGYXI2kBjtXlz9Ckclctx2vJx\n" \
.
.
.
"QknwSFmfYXNRetEcDylKQEI3mkHxtj/jkDrOLitk0ccNQAeou/cL\n" \
"-----END RSA PRIVATE KEY-----\n"

#define CLIENT_PUBLIC_CERTIFICATE \
"-----BEGIN CERTIFICATE-----\n" \
"MIIDkjCCAnoCFGlpDDWDAA00v8MltxDoTLzJH6EiMA0GCSqGSIb3DQEBCwUAMIGJ\n" \
.
.
.
"yQyqplp/\n" \
"-----END CERTIFICATE-----\n"

#define CA_CERTIFICATE \
"-----BEGIN CERTIFICATE-----\n" \
"MIID9TCCAt2gAwIBAgIUSQtJI7ktYmj7qE3tDGGlDTjxrWAwDQYJKoZIhvcNAQEL\n" \
.
.
.
"jmLwN36BmvVGOkXHwOaBgCbFon1negAwX7bO0fXJlwySKO/gIvo1B/FZnP3TdRoD\n" \
"agXksMq8cbMC\n" \
"-----END CERTIFICATE-----\n"

RE: How to use MQTT+TLS in nRF9160?

Kenta — Mon, 17 Jun 2019 10:38:19 GMT

Hi, Yusuke.

It's a code that Hakon told me, it looks like this.

AWS IoT Policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}

CMakeLists.txt

#
# Copyright (c) 2018 Nordic Semiconductor
#
# SPDX-License-Identifier: LicenseRef-BSD-5-Clause-Nordic
#

cmake_minimum_required(VERSION 3.8.2)

include(../../../cmake/boilerplate.cmake)
include($ENV{ZEPHYR_BASE}/cmake/app/boilerplate.cmake NO_POLICY_SCOPE)
project(mqtt-simple)

# NORDIC SDK APP START
target_sources(app PRIVATE src/main.c)
# NORDIC SDK APP END

Kconfig

#
# Copyright (c) 2018 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-BSD-5-Clause-Nordic
#

menu "MQTT simple sample"


config PROVISION_CERTIFICATES
	bool "Provision of certificate"
	help
		Enable run-time provisioning of certificates from the
		certificates header file selected by using CERTIFICATES_FILE

config CERTIFICATES_FILE
	string "Certificates to use"
	depends on PROVISION_CERTIFICATES
	default "certificates.h"

config SEC_TAG
	int "Security tag to use for the connection"
	default 1

config MQTT_PUB_TOPIC
	string "MQTT publish topic"
	default "myTopic/publish"

config MQTT_SUB_TOPIC
	string "MQTT subscribe topic"
	default "myTopic/subscribe"

config MQTT_CLIENT_ID
	string "MQTT Client ID"
	default "nRF9160-DK"

config MQTT_BROKER_HOSTNAME
	string "MQTT broker hostname"
	default "a544w27l82h92-ats.iot.us-east-1.amazonaws.com"

config MQTT_BROKER_PORT
	int "MQTT broker port"
	default 8883

config MQTT_MESSAGE_BUFFER_SIZE
	int ""
	default 128

config MQTT_PAYLOAD_BUFFER_SIZE
	int ""
	default 128

endmenu

menu "Zephyr Kernel"
source "$ZEPHYR_BASE/Kconfig.zephyr"
endmenu

prj.conf

# General config
CONFIG_TEST_RANDOM_GENERATOR=y

# Networking
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS_OFFLOAD=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y

# LTE link control
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=n

# BSD library
CONFIG_BSD_LIBRARY=y

# AT Host
CONFIG_UART_INTERRUPT_DRIVEN=y
CONFIG_AT_HOST_LIBRARY=y

# MQTT
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y

# Appliaction
#CONFIG_MQTT_PUB_TOPIC="/my/publish/topic"
#CONFIG_MQTT_SUB_TOPIC="/my/subscribe/topic"
#CONFIG_MQTT_CLIENT_ID="my-client-id"
#CONFIG_MQTT_BROKER_HOSTNAME="iot.eclipse.org"
#CONFIG_MQTT_BROKER_PORT=1883

CONFIG_MQTT_PUB_TOPIC="myTopic/publish"
CONFIG_MQTT_SUB_TOPIC="myTopic/subscribe"
CONFIG_MQTT_CLIENT_ID="nRF9160-DK"
CONFIG_MQTT_BROKER_HOSTNAME="a544w27l82h92-ats.iot.us-east-1.amazonaws.com"
CONFIG_MQTT_BROKER_PORT=8883

CONFIG_SEC_TAG=16842753

CONFIG_PROVISION_CERTIFICATES=y
CONFIG_CERTIFICATES_FILE="certificates.h"

# Main thread
CONFIG_MAIN_THREAD_PRIORITY=7
CONFIG_MAIN_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=1024

CONFIG_NO_OPTIMIZATIONS=y

main.c

/*
 * Copyright (c) 2018 Nordic Semiconductor ASA
 *
 * SPDX-License-Identifier: LicenseRef-BSD-5-Clause-Nordic
 */

#include <zephyr.h>
#include <stdio.h>
#include <uart.h>
#include <string.h>

#include <net/mqtt.h>
#include <net/socket.h>
#include <lte_lc.h>

#if defined(CONFIG_PROVISION_CERTIFICATES)
#if defined(CONFIG_BSD_LIBRARY)
#include "nrf_inbuilt_key.h"
#endif
//#include CONFIG_CERTIFICATES_FILE
#endif

#include "certificates.h"

#if defined(CONFIG_MQTT_LIB_TLS)
	static sec_tag_t sec_tag_list[] = { CONFIG_SEC_TAG };
#endif

/* Buffers for MQTT client. */
static u8_t rx_buffer[CONFIG_MQTT_MESSAGE_BUFFER_SIZE];
static u8_t tx_buffer[CONFIG_MQTT_MESSAGE_BUFFER_SIZE];
static u8_t payload_buf[CONFIG_MQTT_PAYLOAD_BUFFER_SIZE];

/* The mqtt client struct */
static struct mqtt_client client;

/* MQTT Broker details. */
static struct sockaddr_storage broker;

/* Connected flag */
static bool connected;

/* File descriptor */
struct pollfd fds;

/**@brief Function to print strings without null-termination
 */
static void data_print(u8_t *prefix, u8_t *data, size_t len)
{
	char buf[len + 1];

	memcpy(buf, data, len);
	buf[len] = 0;
	printk("%s%s\n", prefix, buf);
}

/**@brief Function to publish data on the configured topic
 */
static int data_publish(struct mqtt_client *c, enum mqtt_qos qos,
	u8_t *data, size_t len)
{
	struct mqtt_publish_param param;

	param.message.topic.qos = qos;
	param.message.topic.topic.utf8 = CONFIG_MQTT_PUB_TOPIC;
	param.message.topic.topic.size = strlen(CONFIG_MQTT_PUB_TOPIC);
	param.message.payload.data = data;
	param.message.payload.len = len;
	param.message_id = sys_rand32_get();
	param.dup_flag = 0;
	param.retain_flag = 0;

	data_print("Publish: ", data, len);
	printk("to topic: %s len: %u\n",
		CONFIG_MQTT_PUB_TOPIC,
		(unsigned int)strlen(CONFIG_MQTT_PUB_TOPIC));

	return mqtt_publish(c, &param);
}

/**@brief Function to subscribe to the configured topic
 */
static int subscribe(void)
{
	struct mqtt_topic subscribe_topic = {
		.topic = {
			.utf8 = CONFIG_MQTT_SUB_TOPIC,
			.size = strlen(CONFIG_MQTT_SUB_TOPIC)
		},
		.qos = MQTT_QOS_1_AT_LEAST_ONCE
	};

	const struct mqtt_subscription_list subscription_list = {
		.list = &subscribe_topic,
		.list_count = 1,
		.message_id = 1234
	};

	printk("Subscribing to: %s len %u\n", CONFIG_MQTT_SUB_TOPIC,
		(unsigned int)strlen(CONFIG_MQTT_SUB_TOPIC));

	return mqtt_subscribe(&client, &subscription_list);
}

/**@brief Function to read the published payload.
 */
static int publish_get_payload(struct mqtt_client *c, size_t length)
{
	u8_t *buf = payload_buf;
	u8_t *end = buf + length;

	if (length > sizeof(payload_buf)) {
		return -EMSGSIZE;
	}

	while (buf < end) {
		int ret = mqtt_read_publish_payload(c, buf, end - buf);

		if (ret < 0) {
			if (ret == -EAGAIN) {
				printk("mqtt_read_publish_payload: EAGAIN");
				poll(&fds, 1, K_FOREVER);
				continue;
			}

			return ret;
		}

		if (ret == 0) {
			return -EIO;
		}

		buf += ret;
	}

	return 0;
}

/**@brief MQTT client event handler
 */
void mqtt_evt_handler(struct mqtt_client *const c,
		      const struct mqtt_evt *evt)
{
	int err;

	switch (evt->type) {
	case MQTT_EVT_CONNACK:
		if (evt->result != 0) {
			printk("MQTT connect failed %d\n", evt->result);
			break;
		}

		connected = true;
		printk("[%s:%d] MQTT client connected!\n", __func__, __LINE__);
		subscribe();
		break;

	case MQTT_EVT_DISCONNECT:
		printk("[%s:%d] MQTT client disconnected %d\n", __func__,
		       __LINE__, evt->result);

		connected = false;
		break;

	case MQTT_EVT_PUBLISH: {
		const struct mqtt_publish_param *p = &evt->param.publish;

		printk("[%s:%d] MQTT PUBLISH result=%d len=%d\n", __func__,
		       __LINE__, evt->result, p->message.payload.len);
		err = publish_get_payload(c, p->message.payload.len);
		if (err >= 0) {
			data_print("Received: ", payload_buf,
				p->message.payload.len);
			/* Echo back received data */
			//data_publish(&client, MQTT_QOS_1_AT_LEAST_ONCE,
			//	payload_buf, p->message.payload.len);
		} else {
			printk("mqtt_read_publish_payload: Failed! %d\n", err);
		}
	} break;

	case MQTT_EVT_PUBACK:
		if (evt->result != 0) {
			printk("MQTT PUBACK error %d\n", evt->result);
			break;
		}

		printk("[%s:%d] PUBACK packet id: %u\n", __func__, __LINE__,
				evt->param.puback.message_id);
		break;

	case MQTT_EVT_SUBACK:
		if (evt->result != 0) {
			printk("MQTT SUBACK error %d\n", evt->result);
			break;
		}

		printk("[%s:%d] SUBACK packet id: %u\n", __func__, __LINE__,
				evt->param.suback.message_id);
		break;

	default:
		printk("[%s:%d] default: %d\n", __func__, __LINE__,
				evt->type);
		break;
	}
}

/**@brief Resolves the configured hostname and
 * initializes the MQTT broker structure
 */
static void broker_init(void)
{
	int err;
	struct addrinfo *result;
	struct addrinfo *addr;
	struct addrinfo hints;

	hints.ai_flags = 0;
	hints.ai_family = AF_INET;
	hints.ai_socktype = SOCK_STREAM;
	hints.ai_protocol = 0;

	err = getaddrinfo(CONFIG_MQTT_BROKER_HOSTNAME, NULL, &hints, &result);
	if (err) {
		printk("ERROR: getaddrinfo failed %d\n", err);

		return;
	}

	addr = result;
	err = -ENOENT;

	/* Look for address of the broker. */
	while (addr != NULL) {
		/* IPv4 Address. */
		if (addr->ai_addrlen == sizeof(struct sockaddr_in)) {
			struct sockaddr_in *broker4 =
				((struct sockaddr_in *)&broker);

			broker4->sin_addr.s_addr =
				((struct sockaddr_in *)addr->ai_addr)
				->sin_addr.s_addr;
			broker4->sin_family = AF_INET;
			broker4->sin_port = htons(CONFIG_MQTT_BROKER_PORT);
			printk("IPv4 Address found 0x%08x\n",
				broker4->sin_addr.s_addr);
			break;
		} else {
			printk("ai_addrlen = %u should be %u or %u\n",
				(unsigned int)addr->ai_addrlen,
				(unsigned int)sizeof(struct sockaddr_in),
				(unsigned int)sizeof(struct sockaddr_in6));
		}

		addr = addr->ai_next;
		break;
	}

	/* Free the address. */
	freeaddrinfo(result);
}

/**@brief Initialize the MQTT client structure
 */
static void client_init(struct mqtt_client *client)
{
	mqtt_client_init(client);

	broker_init();

	/* MQTT client configuration */
	client->broker = &broker;
	client->evt_cb = mqtt_evt_handler;
	client->client_id.utf8 = (u8_t *)CONFIG_MQTT_CLIENT_ID;
	client->client_id.size = strlen(CONFIG_MQTT_CLIENT_ID);
	client->password = NULL;
	client->user_name = NULL;
	client->protocol_version = MQTT_VERSION_3_1_1;

	/* MQTT buffers configuration */
	client->rx_buf = rx_buffer;
	client->rx_buf_size = sizeof(rx_buffer);
	client->tx_buf = tx_buffer;
	client->tx_buf_size = sizeof(tx_buffer);

	/* MQTT transport configuration */
#if defined(CONFIG_MQTT_LIB_TLS)
	struct mqtt_sec_config *tls_config = &client->transport.tls.config;
	
	client->transport.type = MQTT_TRANSPORT_SECURE;

	tls_config->peer_verify = 2;
	tls_config->cipher_count = 0;
	tls_config->cipher_list = NULL;
	tls_config->sec_tag_count = ARRAY_SIZE(sec_tag_list);
	tls_config->sec_tag_list = sec_tag_list;
	tls_config->hostname = CONFIG_MQTT_BROKER_HOSTNAME;
#else
	client->transport.type = MQTT_TRANSPORT_NON_SECURE;
#endif
}

/**@brief Initialize the file descriptor structure used by poll.
 */
static int fds_init(struct mqtt_client *c)
{
	if (c->transport.type == MQTT_TRANSPORT_NON_SECURE) {
		fds.fd = c->transport.tcp.sock;
	} else {
#if defined(CONFIG_MQTT_LIB_TLS)
		fds.fd = c->transport.tls.sock;
#else
		return -ENOTSUP;
#endif
	}

	fds.events = POLLIN;

	return 0;
}

/**@brief Configures modem to provide LTE link. Blocks until link is
 * successfully established.
 */
static void modem_configure(void)
{
#if defined(CONFIG_LTE_LINK_CONTROL)
	if (IS_ENABLED(CONFIG_LTE_AUTO_INIT_AND_CONNECT)) {
		/* Do nothing, modem is already turned on
		 * and connected.
		 */
	} else {
		int err;

		printk("LTE Link Connecting ...\n");
		err = lte_lc_init_and_connect();
		__ASSERT(err == 0, "LTE link could not be established.");
		printk("LTE Link Connected!\n");
	}
#endif
}

static int provision_certificate(void)
{
#if defined(CONFIG_PROVISION_CERTIFICATES)
#if defined(CONFIG_BSD_LIBRARY)
	{
		int err;

		/* Delete certificates */
		nrf_sec_tag_t sec_tag = (nrf_sec_tag_t) sec_tag_list[0];

		for (nrf_key_mgnt_cred_type_t type = 0; type < 5; type++) {
			printk("Deleting certs sec_tag: %d\n", sec_tag);
			err = nrf_inbuilt_key_delete(sec_tag, type);
			printk("nrf_inbuilt_key_delete(%u, %d) => result=%d\n",
				sec_tag, type, err);
		}

#if defined(CA_CERTIFICATE)
		/* Provision CA Certificate. */
		printk("Write ca certs sec_tag: %d\n", sec_tag);
		err = nrf_inbuilt_key_write(sec_tag,
			NRF_KEY_MGMT_CRED_TYPE_CA_CHAIN,
			CA_CERTIFICATE,
			strlen(CA_CERTIFICATE));
		if (err) {
			printk("CA_CERTIFICATE err: %d\n", err);
			return err;
		}
#endif
#if defined (CLIENT_PRIVATE_KEY)
		/* Provision Private Certificate. */
		printk("Write private cert sec_tag: %d\n", sec_tag);
		err = nrf_inbuilt_key_write(
			sec_tag,
			NRF_KEY_MGMT_CRED_TYPE_PRIVATE_CERT,
			CLIENT_PRIVATE_KEY,
			strlen(CLIENT_PRIVATE_KEY));
		if (err) {
			printk("CLIENT_PRIVATE_KEY err: %d\n", err);
			return err;
		}
#endif
#if defined(CLIENT_PUBLIC_CERTIFICATE)
		/* Provision Public Certificate. */
		printk("Write public cert sec_tag: %d\n", sec_tag);
		err = nrf_inbuilt_key_write(
			sec_tag,
			NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT,
			CLIENT_PUBLIC_CERTIFICATE,
			strlen(CLIENT_PUBLIC_CERTIFICATE));
		if (err) {
			printk("CLIENT_PUBLIC_CERTIFICATE err: %d\n",
				err);
			return err;
		}
	}
#endif
#else
	{
		int err;

		err = tls_credential_add(CONFIG_SEC_TAG,
			TLS_CREDENTIAL_CA_CERTIFICATE,
			NRF_CLOUD_CA_CERTIFICATE,
			sizeof(NRF_CLOUD_CA_CERTIFICATE));
		if (err < 0) {
			printk("Failed to register ca certificate: %d\n",
				err);
			return err;
		}
		err = tls_credential_add(CONFIG_SEC_TAG,
			TLS_CREDENTIAL_PRIVATE_KEY,
			NRF_CLOUD_CLIENT_PRIVATE_KEY,
			sizeof(NRF_CLOUD_CLIENT_PRIVATE_KEY));
		if (err < 0) {
			printk("Failed to register private key: %d\n",
				err);
			return err;
		}
		err = tls_credential_add(CONFIG_SEC_TAG,
			TLS_CREDENTIAL_SERVER_CERTIFICATE,
			NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE,
			sizeof(NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE));
		if (err < 0) {
			printk("Failed to register public certificate: %d\n",
				err);
			return err;
		}

	}
#endif /* defined(CONFIG_BSD_LIBRARY) */
#endif /* defined(CONFIG_PROVISION_CERTIFICATES) */

	return 0;
}

void main(void)
{
	int err;

//	if (!IS_ENABLED(CONFIG_AT_HOST_LIBRARY)) {
//		/* Stop the UART RX for power consumption reasons */
//		NRF_UARTE0_NS->TASKS_STOPRX = 1;
//		NRF_UARTE1_NS->TASKS_STOPRX = 1;
//	}

	printk("The MQTT simple sample started\n");

	provision_certificate();

	modem_configure();

	client_init(&client);

	err = mqtt_connect(&client);
	if (err != 0) {
		printk("ERROR: mqtt_connect %d\n", err);
		return;
	}

	err = fds_init(&client);
	if (err != 0) {
		printk("ERROR: fds_init %d\n", err);
		return;
	}

	while (1) {
		err = mqtt_input(&client);
		if (err != 0) {
			printk("ERROR: mqtt_input %d\n", err);
		}

		err = mqtt_live(&client);
		if (err != 0) {
			printk("ERROR: mqtt_live %d\n", err);
		}

		if (poll(&fds, 1, K_SECONDS(CONFIG_MQTT_KEEPALIVE)) < 0) {
			printk("ERROR: poll %d\n", errno);
		}
	}
}

certificates.h

/*
 * Copyright (c) 2018 Nordic Semiconductor ASA
 *
 * SPDX-License-Identifier: BSD-5-Clause-Nordic
 */

#define CLIENT_ID "nRF9160-DK"

#define CLIENT_PRIVATE_KEY \
"-----BEGIN RSA PRIVATE KEY-----\n" \
"MIIEowIBAAKCAQEAx4Ye6j54swxVmXg4DgMLq7SGTPDgX//OxX+gIyuElg++Y8Zc\n" \
・
・
・
"9YdCxdXEaJuCQP9Hk/sZntiYWDr+OS0LGLPgwZvx/6zdsgA8fwwo\n" \
"-----END RSA PRIVATE KEY-----\n"



#define CLIENT_PUBLIC_CERTIFICATE \
"-----BEGIN CERTIFICATE-----\n" \
"MIIDWjCCAkKgAwIBAgIVAIZKJS0Jwvc+y4xucM8EsLALOr1HMA0GCSqGSIb3DQEB\n" \
・
・
・
"udQi+rS7NNaOXeRF46P4gAfgSmeSqOAKjrDRsZKYBip1yXclOZFRTUTlvpSYQA==\n" \
"-----END CERTIFICATE-----\n"



#define CA_CERTIFICATE \
"-----BEGIN CERTIFICATE-----\n" \
"MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF\n" \
・
・
・
"rqXRfboQnoZsG4q5WTP468SQvvG5\n" \
"-----END CERTIFICATE-----\n"

RE: How to use MQTT+TLS in nRF9160?

Yusuke — Sun, 16 Jun 2019 14:26:44 GMT

I modified code but it doesn't work well... Could you give me advice?

I tested mqtt broker(mosquitto) with tls with another MQTT client and it works fine. The broker should be ok.

The broker doesn't receive message from the client in this project.

<console result>

Peripheral              Domain          Status
00 NRF_P0               Non-Secure      OK
01 NRF_CLOCK            Non-Secure      OK
02 NRF_RTC1             Non-Secure      OK
03 NRF_NVMC             Non-Secure      OK
04 NRF_UARTE1           Non-Secure      OK
05 NRF_UARTE2           Secure          SKIP
06 NRF_IPC              Non-Secure      OK
07 NRF_VMC              Non-Secure      OK
08 NRF_FPU              Non-Secure      OK
09 NRF_EGU1             Non-Secure      OK
10 NRF_EGU2             Non-Secure      OK
11 NRF_TWIM2            Non-Secure      OK
12 NRF_SPIM3            Non-Secure      OK
13 NRF_TIMER0           Non-Secure      OK
14 NRF_TIMER1           Non-Secure      OK
15 NRF_TIMER2           Non-Secure      OK
16 NRF_SAADC            Non-Secure      OK
17 NRF_GPIOTE1          Non-Secure      OK

SPM: NS image at 0x8000
SPM: NS MSP at 0x200238e0
SPM: NS reset vector at 0xa2b5
SPM: prepare to jump to Non-Secure image.
***** Booting Zephyr OS v1.14.99-ncs1 *****
The MQTT simple sample started
LTE Link Connecting ...
LTE Link Connected!
IPv4 Address found 0x5e7fda12
ERROR: mqtt_connect -45

<certificates.h>

#ifndef _CERTIFICATES_H_
#define _CERTIFICATES_H_

#define NRF_CLOUD_CLIENT_PRIVATE_KEY \
    "-----BEGIN RSA PRIVATE KEY-----\n" \
    "MIIEowIBAAKCAQEAyoE5FG1Hf9DFEA1iF9enHtxNGYXI2kBjtXlz9Ckclctx2vJx\n" \
    .
    .
    .
    "QknwSFmfYXNRetEcDylKQEI3mkHxtj/jkDrOLitk0ccNQAeou/cL\n" \
    "-----END RSA PRIVATE KEY-----\n"

#define NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE \
    "-----BEGIN CERTIFICATE-----\n" \
    "MIIDkjCCAnoCFGlpDDWDAA00v8MltxDoTLzJH6EiMA0GCSqGSIb3DQEBCwUAMIGJ\n" \
    .
    .
    .
    "yQyqplp/\n" \
    "-----END CERTIFICATE-----\n"

#define NRF_CLOUD_CA_CERTIFICATE \
    "-----BEGIN CERTIFICATE-----\n" \
    "MIID9TCCAt2gAwIBAgIUSQtJI7ktYmj7qE3tDGGlDTjxrWAwDQYJKoZIhvcNAQEL\n" \
    .
    .
    .
    "agXksMq8cbMC\n" \
    "-----END CERTIFICATE-----\n"

#endif /* _CERTIFICATES_H_ */

<prj.conf>

# General config
CONFIG_TEST_RANDOM_GENERATOR=y

# Networking
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS_OFFLOAD=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y

# LTE link control
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_NETWORK_MODE_LTE_M=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=n
# CONFIG_LTE_EDRX_REQ_ACTT_TYPE="4"
# CONFIG_LTE_EDRX_REQ=y
# CONFIG_LTE_EDRX_REQ_VALUE="0110"
# 0100 81.92sec
# 0101 163.84sec
# 0110 327.68sec
# 0111 655.36sec

# LTE link control
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=n

# BSD library
CONFIG_BSD_LIBRARY=y

# AT Host
CONFIG_UART_INTERRUPT_DRIVEN=y
CONFIG_AT_HOST_LIBRARY=y

# MQTT
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y

# Appliaction
CONFIG_MQTT_PUB_TOPIC="myPubTopic"
CONFIG_MQTT_SUB_TOPIC="mySubTopic"
CONFIG_MQTT_CLIENT_ID="myClientID"
CONFIG_MQTT_BROKER_HOSTNAME="xxxxxxxxxxxxxx.com"
CONFIG_MQTT_BROKER_PORT=8883
CONFIG_MQTT_KEEPALIVE=300
CONFIG_MQTT_TLS_SEC_TAG=16842753

# Main thread
CONFIG_MAIN_THREAD_PRIORITY=7
CONFIG_MAIN_STACK_SIZE=4096

CONFIG_HEAP_MEM_POOL_SIZE=1024

<Kconfig>

menu "MQTT simple sample"

config PROVISION_CERTIFICATES
	bool "Provision of certificate"
	help
		Enable run-time provisioning of certificates from the
		certificates header file selected by using CERTIFICATES_FILE

config CERTIFICATES_FILE
	string "Certificates to use"
	depends on PROVISION_CERTIFICATES
	default "certificates.h"

config SEC_TAG
	int "Security tag to use for the connection"
	default 1

config MQTT_PUB_TOPIC
	string "MQTT publish topic"
	default "my/publish/topic"

config MQTT_SUB_TOPIC
	string "MQTT subscribe topic"
	default "my/subscribe/topic"

config MQTT_CLIENT_ID
	string "MQTT Client ID"
	default "my-client-id"

config MQTT_BROKER_HOSTNAME
	string "MQTT broker hostname"
	default "iot.eclipse.org"

config MQTT_BROKER_PORT
	int "MQTT broker port"
	default 1883

config MQTT_MESSAGE_BUFFER_SIZE
	int ""
	default 128

config MQTT_PAYLOAD_BUFFER_SIZE
	int ""
	default 128

config MQTT_KEEPALIVE
	int ""
	default 60

endmenu

menu "Zephyr Kernel"
source "$ZEPHYR_BASE/Kconfig.zephyr"
endmenu

I copied main.c code below to my project and modified it a little bit.
https://github.com/joakimtoe/fw-nrfconnect-nrf/commit/36532a8ca60bf7139a988b5cbb4e6cb47948a9fa

I defined NRF_CLOUD_CLIENT_ID in main.c instedf of in certificates.h

<main.c>

#include <zephyr.h>
#include <stdio.h>
#include <uart.h>
#include <string.h>

#include <net/mqtt.h>
#include <net/socket.h>
#include <lte_lc.h>

#define MQTT_USERNAME "username"
#define MQTT_PASSWORD "password"
#define NRF_CLOUD_CLIENT_ID CONFIG_MQTT_CLIENT_ID

#if defined(CONFIG_PROVISION_CERTIFICATES)
#if defined(CONFIG_BSD_LIBRARY)
#include "nrf_inbuilt_key.h"
#endif
#include CONFIG_CERTIFICATES_FILE
#endif

#if defined(CONFIG_MQTT_LIB_TLS)
	static sec_tag_t sec_tag_list[] = { CONFIG_SEC_TAG };
#endif

/* Buffers for MQTT client. */
static u8_t rx_buffer[CONFIG_MQTT_MESSAGE_BUFFER_SIZE];
static u8_t tx_buffer[CONFIG_MQTT_MESSAGE_BUFFER_SIZE];
static u8_t payload_buf[CONFIG_MQTT_PAYLOAD_BUFFER_SIZE];
.
.
.
/**@brief Initialize the MQTT client structure
 */
static void client_init(struct mqtt_client *client)
{
	mqtt_client_init(client);

	broker_init();

    /* Add from here */
    static struct mqtt_utf8 password;
	static struct mqtt_utf8 user_name;

	password.utf8 = (u8_t *)MQTT_PASSWORD;
	password.size = strlen(MQTT_PASSWORD);
	user_name.utf8 = (u8_t *)MQTT_USERNAME;
	user_name.size = strlen(MQTT_USERNAME);
    /* to here */

	/* MQTT client configuration */
	client->broker = &broker;
	client->evt_cb = mqtt_evt_handler;
	client->client_id.utf8 = (u8_t *)CONFIG_MQTT_CLIENT_ID;
	client->client_id.size = strlen(CONFIG_MQTT_CLIENT_ID);
	client->password = &password; // Add here
	client->user_name = &user_name; // Add here
	client->protocol_version = MQTT_VERSION_3_1_0; // originally MQTT_VERSION_3_1_1

	/* MQTT buffers configuration */
	client->rx_buf = rx_buffer;
	client->rx_buf_size = sizeof(rx_buffer);
	client->tx_buf = tx_buffer;
	client->tx_buf_size = sizeof(tx_buffer);

	/* MQTT transport configuration */ 
    /* MODIFIED HERE */
    #if defined(CONFIG_MQTT_LIB_TLS)
        struct mqtt_sec_config *tls_config = &client->transport.tls.config;
        client->transport.type = MQTT_TRANSPORT_SECURE;

        tls_config->peer_verify = 2;
        tls_config->cipher_count = 0;
        tls_config->cipher_list = NULL;
        tls_config->sec_tag_count = ARRAY_SIZE(sec_tag_list);
        tls_config->sec_tag_list = sec_tag_list;
        tls_config->hostname = CONFIG_MQTT_BROKER_HOSTNAME;
    #else
       client->transport.type = MQTT_TRANSPORT_NON_SECURE;
    #endif
}
.
.
.
static int provision_certificate(void)
{
#if defined(CONFIG_PROVISION_CERTIFICATES)
#if defined(CONFIG_BSD_LIBRARY)
	{
		int err;

		/* Delete certificates */
		nrf_sec_tag_t sec_tag = (nrf_sec_tag_t) sec_tag_list[0];

		for (nrf_key_mgnt_cred_type_t type = 0; type < 5; type++) {
			printk("Deleting certs sec_tag: %d\n", sec_tag);
			err = nrf_inbuilt_key_delete(sec_tag, type);
			printk("nrf_inbuilt_key_delete(%u, %d) => result=%d\n",
				sec_tag, type, err);
		}

#if defined(CA_CERTIFICATE)
		/* Provision CA Certificate. */
		printk("Write ca certs sec_tag: %d\n", sec_tag);
		err = nrf_inbuilt_key_write(sec_tag,
			NRF_KEY_MGMT_CRED_TYPE_CA_CHAIN,
			CA_CERTIFICATE,
			strlen(CA_CERTIFICATE));
		if (err) {
			printk("CA_CERTIFICATE err: %d\n", err);
			return err;
		}
#endif
#if defined (CLIENT_PRIVATE_KEY)
		/* Provision Private Certificate. */
		printk("Write private cert sec_tag: %d\n", sec_tag);
		err = nrf_inbuilt_key_write(
			sec_tag,
			NRF_KEY_MGMT_CRED_TYPE_PRIVATE_CERT,
			CLIENT_PRIVATE_KEY,
			strlen(CLIENT_PRIVATE_KEY));
		if (err) {
			printk("CLIENT_PRIVATE_KEY err: %d\n", err);
			return err;
		}
#endif
#if defined(CLIENT_PUBLIC_CERTIFICATE)
		/* Provision Public Certificate. */
		printk("Write public cert sec_tag: %d\n", sec_tag);
		err = nrf_inbuilt_key_write(
			sec_tag,
			NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT,
			CLIENT_PUBLIC_CERTIFICATE,
			strlen(CLIENT_PUBLIC_CERTIFICATE));
		if (err) {
			printk("CLIENT_PUBLIC_CERTIFICATE err: %d\n",
				err);
			return err;
		}
	}
#endif
#else
	{
		int err;

		err = tls_credential_add(CONFIG_SEC_TAG,
			TLS_CREDENTIAL_CA_CERTIFICATE,
			NRF_CLOUD_CA_CERTIFICATE,
			sizeof(NRF_CLOUD_CA_CERTIFICATE));
		if (err < 0) {
			printk("Failed to register ca certificate: %d\n",
				err);
			return err;
		}
		err = tls_credential_add(CONFIG_SEC_TAG,
			TLS_CREDENTIAL_PRIVATE_KEY,
			NRF_CLOUD_CLIENT_PRIVATE_KEY,
			sizeof(NRF_CLOUD_CLIENT_PRIVATE_KEY));
		if (err < 0) {
			printk("Failed to register private key: %d\n",
				err);
			return err;
		}
		err = tls_credential_add(CONFIG_SEC_TAG,
			TLS_CREDENTIAL_SERVER_CERTIFICATE,
			NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE,
			sizeof(NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE));
		if (err < 0) {
			printk("Failed to register public certificate: %d\n",
				err);
			return err;
		}

	}
#endif /* defined(CONFIG_BSD_LIBRARY) */
#endif /* defined(CONFIG_PROVISION_CERTIFICATES) */

	return 0;
}

void main(void)
{
	int err;

	if (!IS_ENABLED(CONFIG_AT_HOST_LIBRARY)) {
		/* Stop the UART RX for power consumption reasons */
		NRF_UARTE0_NS->TASKS_STOPRX = 1;
		NRF_UARTE1_NS->TASKS_STOPRX = 1;
	}

	printk("The MQTT simple sample started\n");

	provision_certificate();

	modem_configure();

	client_init(&client);

	err = mqtt_connect(&client);
	if (err != 0) {
		printk("ERROR: mqtt_connect %d\n", err); // eror here
		return;
	}

	err = fds_init(&client);
	if (err != 0) {
		printk("ERROR: fds_init %d\n", err);
		return;
	}
	
	while (1) {
	    .
	    .
	}
}

RE: How to use MQTT+TLS in nRF9160?

Kenta — Wed, 12 Jun 2019 15:26:01 GMT

Hi, Hakon.

Thanks. It worked so well.

RE: How to use MQTT+TLS in nRF9160?

Hakon — Tue, 11 Jun 2019 12:14:32 GMT

Hello, please refer to this commit to see how it's done. The certificates should be put in certificates.h.

RE: How to use MQTT+TLS in nRF9160?

Kenta — Mon, 10 Jun 2019 17:15:32 GMT

Hi !

prj.conf

# General config
CONFIG_TEST_RANDOM_GENERATOR=y
CONFIG_SPM=n
CONFIG_STDOUT_CONSOLE=y
CONFIG_NEWLIB_LIBC=y

# Networking
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_OFFLOAD=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y

# LTE link control
#CONFIG_POWER_OPTIMIZATION_ENABLE=n
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=n

# nRF Cloud
CONFIG_NRF_CLOUD_PROVISION_CERTIFICATES=y
#CONFIG_NRF_CLOUD=y

# Modem info
#CONFIG_MODEM_INFO=y

# BSD library
CONFIG_BSD_LIBRARY=y

# AT Host
CONFIG_UART_INTERRUPT_DRIVEN=y
CONFIG_AT_HOST_LIBRARY=y

# MQTT
#CONFIG_MQTT_LIB=y
CONFIG_MQTT_SOCKET_LIB=y
CONFIG_MQTT_LIB_TLS=y
CONFIG_MQTT_MAX_PACKET_LENGTH=2048


# Appliaction
#CONFIG_MQTT_PUB_TOPIC="my/publish/topic"
#CONFIG_MQTT_SUB_TOPIC="my/subscribe/topic"

CONFIG_MQTT_PUB_TOPIC="myTopic/publish"
CONFIG_MQTT_SUB_TOPIC="myTopic/subscribe"
CONFIG_MQTT_CLIENT_ID="nRF9160-DK"
CONFIG_MQTT_BROKER_HOSTNAME="a544w27l82h92-ats.iot.us-east-1.amazonaws.com"
CONFIG_MQTT_BROKER_PORT= 8883

CONFIG_NRF_CLOUD_SEC_TAG=1234



# Main thread
CONFIG_MAIN_THREAD_PRIORITY=7
#CONFIG_MAIN_STACK_SIZE=4096
#CONFIG_HEAP_MEM_POOL_SIZE=1024

CONFIG_HEAP_MEM_POOL_SIZE=16384
CONFIG_MAIN_STACK_SIZE=8192
CONFIG_GPS_SIM_THREAD_STACK_SIZE=1024
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=1500
CONFIG_HW_STACK_PROTECTION=y

main.c

/*
 * Copyright (c) 2018 Nordic Semiconductor ASA
 *
 * SPDX-License-Identifier: LicenseRef-BSD-5-Clause-Nordic
 */

#include <zephyr.h>
#include <stdio.h>
#include <uart.h>
#include <string.h>

#include <net/mqtt.h>
#include <net/socket.h>
#include <lte_lc.h>

#if defined(CONFIG_BSD_LIBRARY)
#include "nrf_inbuilt_key.h"
#endif

#include "certificates.h"

/*
 * Copyright (c) 2018 Nordic Semiconductor ASA
 *
 * SPDX-License-Identifier: BSD-5-Clause-Nordic
 */

//#define CONFIG_NRF_CLOUD_SEC_TAG 1
#define NRF_CLOUD_HOSTNAME CONFIG_MQTT_BROKER_HOSTNAME
//#define NRF_CLOUD_SEC_TAG  CONFIG_NRF_CLOUD_SEC_TAG

static struct nct {
    struct mqtt_sec_config tls_config;
    struct mqtt_client client;
    struct sockaddr_storage broker;
    struct mqtt_utf8 dc_tx_endp;
    struct mqtt_utf8 dc_rx_endp;
    u32_t message_id;
} nct;


/* Buffers for MQTT client. */
static u8_t rx_buffer[CONFIG_MQTT_MESSAGE_BUFFER_SIZE];
static u8_t tx_buffer[CONFIG_MQTT_MESSAGE_BUFFER_SIZE];
static u8_t payload_buf[CONFIG_MQTT_PAYLOAD_BUFFER_SIZE];

/* The mqtt client struct */
static struct mqtt_client client;

/* MQTT Broker details. */
static struct sockaddr_storage broker;

/* Connected flag */
static bool connected;

/* File descriptor */
static struct pollfd fds;

#if defined(CONFIG_BSD_LIBRARY)

/**@brief Recoverable BSD library error. */
void bsd_recoverable_error_handler(uint32_t err)
{
	printk("bsdlib recoverable error: %u\n", err);
}

/**@brief Irrecoverable BSD library error. */
void bsd_irrecoverable_error_handler(uint32_t err)
{
	printk("bsdlib irrecoverable error: %u\n", err);

	__ASSERT_NO_MSG(false);
}

#endif /* defined(CONFIG_BSD_LIBRARY) */

/**@brief Function to print strings without null-termination
 */
static void data_print(u8_t *prefix, u8_t *data, size_t len)
{
	char buf[len + 1];

	memcpy(buf, data, len);
	buf[len] = 0;
	printk("%s%s\n", prefix, buf);
}

static void data_sub_print(u8_t *prefix, u8_t *data, size_t len)
{
    printk("data_sub_print\n");
    printk("%s%s\n", prefix, data);
    printk("data receive end.\n");
    //printk("%s", data);
    //for(int i=0; i<len; i++){
    //    printk("%d", data[i]);
    //}
    //printk("\n");
    
}

/**@brief Function to publish data on the configured topic
 */
static int data_publish(struct mqtt_client *c, enum mqtt_qos qos,
	u8_t *data, size_t len)
{
	struct mqtt_publish_param param;

	param.message.topic.qos = qos;
	param.message.topic.topic.utf8 = CONFIG_MQTT_PUB_TOPIC;
	param.message.topic.topic.size = strlen(CONFIG_MQTT_PUB_TOPIC);
	param.message.payload.data = data;
	param.message.payload.len = len;
	param.message_id = sys_rand32_get();
	param.dup_flag = 0;
	param.retain_flag = 0;

	data_print("Publishing: ", data, len);
	printk("to topic: %s len: %u\n",
		CONFIG_MQTT_PUB_TOPIC,
		(unsigned int)strlen(CONFIG_MQTT_PUB_TOPIC));

	return mqtt_publish(c, &param);
}

/**@brief Function to subscribe to the configured topic
 */
static int subscribe(void)
{
	struct mqtt_topic subscribe_topic = {
		.topic = {
			.utf8 = CONFIG_MQTT_SUB_TOPIC,
			.size = strlen(CONFIG_MQTT_SUB_TOPIC)
		},
		.qos = MQTT_QOS_1_AT_LEAST_ONCE
	};

	const struct mqtt_subscription_list subscription_list = {
		.list = &subscribe_topic,
		.list_count = 1,
		.message_id = 1234
	};

	printk("Subscribing to: %s len %u\n", CONFIG_MQTT_SUB_TOPIC,
		(unsigned int)strlen(CONFIG_MQTT_SUB_TOPIC));

	return mqtt_subscribe(&client, &subscription_list);
}

/**@brief Function to read the published payload.
 */
static int publish_get_payload(struct mqtt_client *c, size_t length)
{
	u8_t *buf = payload_buf;
	u8_t *end = buf + length;

	if (length > sizeof(payload_buf)) {
		return -EMSGSIZE;
	}

	while (buf < end) {
		//int ret = mqtt_read_publish_payload(c, buf, end - buf);
                int ret = 0;
		if (ret < 0) {
			int err;

			if (ret != -EAGAIN) {
				return ret;
			}

			printk("mqtt_read_publish_payload: EAGAIN\n");

			err = poll(&fds, 1, K_SECONDS(CONFIG_MQTT_KEEPALIVE));
			if (err > 0 && (fds.revents & POLLIN) == POLLIN) {
				continue;
			} else {
				return -EIO;
			}
		}

		if (ret == 0) {
			return -EIO;
		}

		buf += ret;
	}

	return 0;
}

//static int subscribe_get_payload(struct mqtt_binstr)
//{
//
//}

/**@brief MQTT client event handler
 */
void mqtt_evt_handler(struct mqtt_client *const c,
		      const struct mqtt_evt *evt)
{
	int err;

	switch (evt->type) {
	case MQTT_EVT_CONNACK:
		if (evt->result != 0) {
			printk("MQTT connect failed %d\n", evt->result);
			break;
		}

		connected = true;
		printk("[%s:%d] MQTT client connected!\n", __func__, __LINE__);
		subscribe();
		break;

	case MQTT_EVT_DISCONNECT:
		printk("[%s:%d] MQTT client disconnected %d\n", __func__,
		       __LINE__, evt->result);

		connected = false;
		break;

	case MQTT_EVT_PUBLISH: {
		const struct mqtt_publish_param *p = &evt->param.publish;

		printk("[%s:%d] MQTT PUBLISH result=%d len=%d\n", __func__,
		       __LINE__, evt->result, p->message.payload.len);
		
//                err = publish_get_payload(c, p->message.payload.len);
//		if (err >= 0) {
//			data_print("Received: ", payload_buf,
//				p->message.payload.len);
//			/* Echo back received data */
//			//data_publish(&client, MQTT_QOS_1_AT_LEAST_ONCE,
//			//	payload_buf, p->message.payload.len);
//		} else {
//			printk("mqtt_read_publish_payload: Failed! %d\n", err);
//			printk("Disconnecting MQTT client...\n");
//
//			err = mqtt_disconnect(c);
//			if (err) {
//				printk("Could not disconnect: %d\n", err);
//			}
//		}
	} break;

	case MQTT_EVT_PUBACK:
		if (evt->result != 0) {
			printk("MQTT PUBACK error %d\n", evt->result);
			break;
		}

		printk("[%s:%d] PUBACK packet id: %u\n", __func__, __LINE__,
				evt->param.puback.message_id);
		break;

	case MQTT_EVT_SUBACK:
		if (evt->result != 0) {
			printk("MQTT SUBACK error %d\n", evt->result);
			break;
		}

		printk("[%s:%d] SUBACK packet id: %u\n", __func__, __LINE__,
				evt->param.suback.message_id);
        
                const struct mqtt_suback_param* suback = &evt->param.suback;
        //suback->return_codes->data
                data_sub_print("Subscribe: ", suback->return_codes.data, suback->return_codes.len);
		break;

	default:
		printk("[%s:%d] default: %d\n", __func__, __LINE__,
				evt->type);
		break;
	}
}

/**@brief Resolves the configured hostname and
 * initializes the MQTT broker structure
 */
static void broker_init(void)
{
	int err;
	struct addrinfo *result;
	struct addrinfo *addr;
	struct addrinfo hints = {
		.ai_family = AF_INET,
		.ai_socktype = SOCK_STREAM
	};

	err = getaddrinfo(CONFIG_MQTT_BROKER_HOSTNAME, NULL, &hints, &result);
	if (err) {
		printk("ERROR: getaddrinfo failed %d\n", err);

		return;
	}

	addr = result;
	err = -ENOENT;

	/* Look for address of the broker. */
	while (addr != NULL) {
		/* IPv4 Address. */
		if (addr->ai_addrlen == sizeof(struct sockaddr_in)) {
			struct sockaddr_in *broker4 =
				((struct sockaddr_in *)&broker);

			broker4->sin_addr.s_addr =
				((struct sockaddr_in *)addr->ai_addr)
				->sin_addr.s_addr;
			broker4->sin_family = AF_INET;
			broker4->sin_port = htons(CONFIG_MQTT_BROKER_PORT);
			printk("IPv4 Address found 0x%08x\n",
				broker4->sin_addr.s_addr);
			break;
		} else {
			printk("ai_addrlen = %u should be %u or %u\n",
				(unsigned int)addr->ai_addrlen,
				(unsigned int)sizeof(struct sockaddr_in),
				(unsigned int)sizeof(struct sockaddr_in6));
		}

		addr = addr->ai_next;
		break;
	}

	/* Free the address. */
	freeaddrinfo(result);
}

/**@brief Initialize the MQTT client structure
 */
static void client_init(struct mqtt_client *client)
{
	mqtt_client_init(client);

	broker_init();

	/* MQTT client configuration */
	client->broker = &broker;
	client->evt_cb = mqtt_evt_handler;
	client->client_id.utf8 = (u8_t *)CONFIG_MQTT_CLIENT_ID;
	client->client_id.size = strlen(CONFIG_MQTT_CLIENT_ID);
	client->password = NULL;
	client->user_name = NULL;
	client->protocol_version = MQTT_VERSION_3_1_1;

	/* MQTT buffers configuration */
	client->rx_buf = rx_buffer;
	client->rx_buf_size = sizeof(rx_buffer);
	client->tx_buf = tx_buffer;
	client->tx_buf_size = sizeof(tx_buffer);

	/* MQTT transport configuration */
	//client->transport.type = MQTT_TRANSPORT_NON_SECURE;
#if defined(CONFIG_MQTT_LIB_TLS)

    //nct.client.transport.type = MQTT_TRANSPORT_SECURE;
    //struct mqtt_sec_config *tls_config = &nct.client.transport.tls.config;
    //memcpy(tls_config, &nct.tls_config, sizeof(struct mqtt_sec_config));

    client->transport.type = MQTT_TRANSPORT_SECURE;
    
//    static sec_tag_t sec_tag_list[] = { CONFIG_MY_TAG };
//    struct mqtt_sec_config* tls_config = &client->transport.tls.config;
//
//    tls_config->peer_verify = 2;
//    tls_config->cipher_list = NULL;
//    tls_config->sec_tag_list = sec_tag_list;
//    tls_config->sec_tag_count = ARRAY_SIZE(sec_tag_list);
//    tls_config->hostname = CONFIG_MQTT_BROKER_HOSTNAME;
    
    struct mqtt_sec_config *tls_config = &nct.client.transport.tls.config;
    memcpy(tls_config, &nct.tls_config, sizeof(struct mqtt_sec_config));

#else
    client->transport.type = MQTT_TRANSPORT_NON_SECURE;
#endif
    
}

/**@brief Initialize the file descriptor structure used by poll.
 */
static int fds_init(struct mqtt_client *c)
{
	if (c->transport.type == MQTT_TRANSPORT_NON_SECURE) {
		fds.fd = c->transport.tcp.sock;
	} else {
#if defined(CONFIG_MQTT_LIB_TLS)
		fds.fd = c->transport.tls.sock;
#else
		return -ENOTSUP;
#endif
	}

	fds.events = POLLIN;

	return 0;
}

/**@brief Configures modem to provide LTE link. Blocks until link is
 * successfully established.
 */
static void modem_configure(void)
{
#if defined(CONFIG_LTE_LINK_CONTROL)
	if (IS_ENABLED(CONFIG_LTE_AUTO_INIT_AND_CONNECT)) {
		/* Do nothing, modem is already turned on
		 * and connected.
		 */
	} else {
		int err;

		printk("LTE Link Connecting ...\n");
		err = lte_lc_init_and_connect();
		__ASSERT(err == 0, "LTE link could not be established.");
		printk("LTE Link Connected!\n");
	}
#endif
}


/* Provisions root CA certificate using nrf_inbuilt_key API */
static int nct_provision(void)
{
    static sec_tag_t sec_tag_list[] = {CONFIG_NRF_CLOUD_SEC_TAG};

    nct.tls_config.peer_verify = 2;
    nct.tls_config.cipher_count = 0;
    nct.tls_config.cipher_list = NULL;
    nct.tls_config.sec_tag_count = ARRAY_SIZE(sec_tag_list);
    nct.tls_config.sec_tag_list = sec_tag_list;
    nct.tls_config.hostname = NRF_CLOUD_HOSTNAME;

#if defined(CONFIG_NRF_CLOUD_PROVISION_CERTIFICATES)
#if defined(CONFIG_BSD_LIBRARY)
    {
        int err;

        /* Delete certificates */
        nrf_sec_tag_t sec_tag = CONFIG_NRF_CLOUD_SEC_TAG;

        for (nrf_key_mgnt_cred_type_t type = 0; type < 5; type++) {
            err = nrf_inbuilt_key_delete(sec_tag, type);
            printk("nrf_inbuilt_key_delete(%lu, %d) => result=%d",
                sec_tag, type, err);
        }

        /* Provision CA Certificate. */
        err = nrf_inbuilt_key_write(CONFIG_NRF_CLOUD_SEC_TAG,
                    NRF_KEY_MGMT_CRED_TYPE_CA_CHAIN,
                    NRF_CLOUD_CA_CERTIFICATE,
                    strlen(NRF_CLOUD_CA_CERTIFICATE));
        if (err) {
            printk("NRF_CLOUD_CA_CERTIFICATE err: %d", err);
            return err;
        }

        /* Provision Private Certificate. */
        err = nrf_inbuilt_key_write(
            CONFIG_NRF_CLOUD_SEC_TAG,
            NRF_KEY_MGMT_CRED_TYPE_PRIVATE_CERT,
            NRF_CLOUD_CLIENT_PRIVATE_KEY,
            strlen(NRF_CLOUD_CLIENT_PRIVATE_KEY));
        if (err) {
            printk("NRF_CLOUD_CLIENT_PRIVATE_KEY err: %d", err);
            return err;
        }

        /* Provision Public Certificate. */
        err = nrf_inbuilt_key_write(
            CONFIG_NRF_CLOUD_SEC_TAG,
            NRF_KEY_MGMT_CRED_TYPE_PUBLIC_CERT,
            NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE,
            strlen(NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE));
        if (err) {
            printk("NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE err: %d",
                err);
            return err;
        }
    }
#else
    {
        int err;

        err = tls_credential_add(CONFIG_NRF_CLOUD_SEC_TAG,
            TLS_CREDENTIAL_CA_CERTIFICATE,
            NRF_CLOUD_CA_CERTIFICATE,
            sizeof(NRF_CLOUD_CA_CERTIFICATE));
        if (err < 0) {
            LOG_ERR("Failed to register ca certificate: %d",
                err);
            return err;
        }
        err = tls_credential_add(CONFIG_NRF_CLOUD_SEC_TAG,
            TLS_CREDENTIAL_PRIVATE_KEY,
            NRF_CLOUD_CLIENT_PRIVATE_KEY,
            sizeof(NRF_CLOUD_CLIENT_PRIVATE_KEY));
        if (err < 0) {
            LOG_ERR("Failed to register private key: %d",
                err);
            return err;
        }
        err = tls_credential_add(CONFIG_NRF_CLOUD_SEC_TAG,
            TLS_CREDENTIAL_SERVER_CERTIFICATE,
            NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE,
            sizeof(NRF_CLOUD_CLIENT_PUBLIC_CERTIFICATE));
        if (err < 0) {
            LOG_ERR("Failed to register public certificate: %d",
                err);
            return err;
        }

    }
#endif /* defined(CONFIG_BSD_LIBRARY) */
#endif /* defined(CONFIG_NRF_CLOUD_PROVISION_CERTIFICATES) */

    return 0;
}


void main(void)
{
	int err;

	printk("The MQTT simple sample started\n");
        k_sleep(1000);

    int err_provision = nct_provision();
    if (err_provision != 0) {
        printk("ERROR: nct_provision failure %d\n", err_provision);
        return;
    }
    printk("err_provision = %d\n", err_provision);

	modem_configure();

	client_init(&client);

	err = mqtt_connect(&client);
	if (err != 0) {
		printk("ERROR: mqtt_connect %d\n", err);
		return;
	}
        printk("connect MQTT Broker.\r\n");

	err = fds_init(&client);
	if (err != 0) {
		printk("ERROR: fds_init %d\n", err);
		return;
	}

	while (1) {
		err = poll(&fds, 1, K_SECONDS(CONFIG_MQTT_KEEPALIVE));
		if (err < 0) {
			printk("ERROR: poll %d\n", errno);
			break;
		}

		err = mqtt_live(&client);
		if (err != 0) {
			printk("ERROR: mqtt_live %d\n", err);
			break;
		}

		if ((fds.revents & POLLIN) == POLLIN) {
			err = mqtt_input(&client);
			if (err != 0) {
				printk("ERROR: mqtt_input %d\n", err);
				break;
			}
		}

		if ((fds.revents & POLLERR) == POLLERR) {
			printk("POLLERR\n");
			break;
		}

		if ((fds.revents & POLLNVAL) == POLLNVAL) {
			printk("POLLNVAL\n");
			break;
		}

//                subscribe();
//                k_sleep(K_MSEC(10000));
	}

	printk("Disconnecting MQTT client...\n");

	err = mqtt_disconnect(&client);
	if (err) {
		printk("Could not disconnect MQTT client. Error: %d\n", err);
	}
}

But because it does not work, we are considering other ways already....