This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

How to use MQTT+TLS in nRF9160?

I'm working on a project using nRF9160 DK.

How can you use MQTT+TLS in nRF9160?

Where should ca certificate file be stored?

I modified the code below in mqtt_simple project. What code should I modify additionaly?

<prj.conf>
CONFIG_MQTT_LIB_TLS=y

<main.c>

/**@brief Initialize the MQTT client structure
 */
static void client_init(struct mqtt_client *client)
{
	mqtt_client_init(client);

	broker_init();

        /* Add from here */
        static struct mqtt_utf8 password;
	static struct mqtt_utf8 user_name;

	password.utf8 = (u8_t *)MQTT_PASSWORD;
	password.size = strlen(MQTT_PASSWORD);
	user_name.utf8 = (u8_t *)MQTT_USERNAME;
	user_name.size = strlen(MQTT_USERNAME);
        /* to here */

	/* MQTT client configuration */
	client->broker = &broker;
	client->evt_cb = mqtt_evt_handler;
	client->client_id.utf8 = (u8_t *)CONFIG_MQTT_CLIENT_ID;
	client->client_id.size = strlen(CONFIG_MQTT_CLIENT_ID);
	client->password = &password; // Add here
	client->user_name = &user_name; // Add here
	client->protocol_version = MQTT_VERSION_3_1_0; // originally MQTT_VERSION_3_1_1

	/* MQTT buffers configuration */
	client->rx_buf = rx_buffer;
	client->rx_buf_size = sizeof(rx_buffer);
	client->tx_buf = tx_buffer;
	client->tx_buf_size = sizeof(tx_buffer);

	/* MQTT transport configuration */ 
    /* MODIFIED HERE */
    #if defined(CONFIG_MQTT_LIB_TLS)
       client->transport.type = MQTT_TRANSPORT_SECURE;
       client->transport.tls.config.peer_verify = 0;
       client->transport.tls.config.cipher_count = 0;
       client->transport.tls.config.cipher_list = NULL;
       client->transport.tls.config.sec_tag_count = 0;
       client->transport.tls.config.seg_tag_list = NULL;
       client->transport.tls.config.hostname = NULL;
    #else
       client->transport.type = MQTT_TRANSPORT_NON_SECURE;
    #endif
}

  • Hi, KentaM. Thanks a lot!!

    I'm still in trouble. This is the console print.

    SPM: NS image at 0x8000
    SPM: NS MSP at 0x200240f0
    SPM: NS reset vector at 0xb811
    SPM: prepare to jump to Non-Secure image.
    ***** Booting Zephyr OS v1.14.99-ncs1 *****
    The MQTT simple sample started
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 0) => result=2
    Deleting certs sec_tag: 16842753
    ***** BUS FAULT *****
      Precise data bus error
      BFAR Address: 0x3b61bb53
    ***** Hardware exception *****
    Current thread ID = 0x20020410
    Faulting instruction address = 0x16ad8
    Fatal fault in thread 0x20020410! Aborting.
    nrf_inbuilt_key_delete(16842753, 1) => result=14
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 2) => result=14
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 3) => result=14
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 4) => result=14
    Write ca certs sec_tag: 16842753
    CA_CERTIFICATE err: 14
    LTE Link Connecting ...
    LTE Link Connected!
    ERROR: getaddrinfo failed 22
    ERROR: mqtt_connect -47

    This may tell me that certification files are wrong, but MQTT+TLS works fine with another MQTT client with the same three files(CLIENT_PRIVATE_KEY, CLIENT_PUBLIC_CERTIFICATE, CA_CERTIFICATE). These files are self signed and generated by openssl. 

    In my case, I don't use AWS IoT service. I implemented mosquitto MQTT broker on EC2.

    Do you have any comment?

    <certificates.h> *under the src folder
    
    #define CLIENT_ID "myClientID"
    
    #define CLIENT_PRIVATE_KEY \
    "-----BEGIN RSA PRIVATE KEY-----\n" \
    "MIIEowIBAAKCAQEAyoE5FG1Hf9DFEA1iF9enHtxNGYXI2kBjtXlz9Ckclctx2vJx\n" \
    .
    .
    .
    "QknwSFmfYXNRetEcDylKQEI3mkHxtj/jkDrOLitk0ccNQAeou/cL\n" \
    "-----END RSA PRIVATE KEY-----\n"
    
    #define CLIENT_PUBLIC_CERTIFICATE \
    "-----BEGIN CERTIFICATE-----\n" \
    "MIIDkjCCAnoCFGlpDDWDAA00v8MltxDoTLzJH6EiMA0GCSqGSIb3DQEBCwUAMIGJ\n" \
    .
    .
    .
    "yQyqplp/\n" \
    "-----END CERTIFICATE-----\n"
    
    #define CA_CERTIFICATE \
    "-----BEGIN CERTIFICATE-----\n" \
    "MIID9TCCAt2gAwIBAgIUSQtJI7ktYmj7qE3tDGGlDTjxrWAwDQYJKoZIhvcNAQEL\n" \
    .
    .
    .
    "jmLwN36BmvVGOkXHwOaBgCbFon1negAwX7bO0fXJlwySKO/gIvo1B/FZnP3TdRoD\n" \
    "agXksMq8cbMC\n" \
    "-----END CERTIFICATE-----\n"
    

  • Ah....

    I use AWS IoT Core without using EC2.

    Because it costs a lot for EC2 instances.

    If the MQTT_MESSAGE_BUFFER_SIZE is too long it will result in a BUS FAULT error.

    日本語でも書いておくと、EC2インスタンスではなく、AWS IoT Coreを使っています。

    EC2インスタンスだとお金いっぱいかかるので。

    AWS IoT Coreでエッジデバイスを登録して、証明書とポリシーを設定及びアタッチしてあります。

    BUS FAULTのエラーはMQTT_MESSAGE_BUFFER_SIZEが長すぎるとエラーになったように思います。

  • I see. I'll try AWS IoT Core. BTW, Which do you select in Board Name, nrf9160_pca10090ns or nrf9160_pca10090? Since mqtt_simple works with nrf9160_pca10090ns, I choose nrf9160_pca10090ns when implementing TLS.

  • I tried AWS IoT but I'm still stucked...

    I copied your code above based on mqtt_simple project and then changed MQTT_BROKER_HOSTNAME and MQTT_CLIENT_ID both in Kconfig and prj.conf. I attached certificates.h in src folder, which I downloaded from AWS.

    I can't solve the problem below.... 

    SPM: NS image at 0x8000
    SPM: NS MSP at 0x200240d8
    SPM: NS reset vector at 0xb609
    SPM: prepare to jump to Non-Secure image.
    ***** Booting Zephyr OS v1.14.99-ncs1 *****
    The MQTT simple sample started
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 0) => result=2
    Deleting certs sec_tag: 16842753
    ***** BUS FAULT *****
      Precise data bus error
      BFAR Address: 0x2800460d
    ***** Hardware exception *****
    Current thread ID = 0x200203fc
    Faulting instruction address = 0x1682c
    Fatal fault in thread 0x200203fc! Aborting.
    nrf_inbuilt_key_delete(16842753, 1) => result=14
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 2) => result=14
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 3) => result=14
    Deleting certs sec_tag: 16842753
    nrf_inbuilt_key_delete(16842753, 4) => result=14
    Write ca certs sec_tag: 16842753
    CA_CERTIFICATE err: 14
    LTE Link Connecting ...
    LTE Link Connected!
    ERROR: getaddrinfo failed 22
    ERROR: mqtt_connect -47

    - hardware: nRF9160 DK 0.8.2
    - firmware: 0.7.0-29.alpha
    - nrf ver: 0.4.0

Related