MQTT, using EC PRIVATE KEY to connect to a broker

[Stas Jis]

Hi,
I am using P822601 board (with nRF9160 chip).
Sample project "Serial lte modem" (SDK 1.8).
Faced a problem related to the inability to connect to the MQTT broker when using "EC PRIVATE KEY" via LTE Link Monitor.
AT commands are used to connect:

2022-02-23T07:48:23.978Z DEBUG modem >> AT
2022-02-23T07:48:23.990Z DEBUG modem << OK
2022-02-23T07:48:24.697Z DEBUG modem >> AT+CFUN?
2022-02-23T07:48:24.712Z DEBUG modem << +CFUN: 0
2022-02-23T07:48:24.724Z DEBUG modem << OK
2022-02-23T07:48:28.448Z INFO Updating CA certificate...
2022-02-23T07:48:28.452Z DEBUG modem >> AT%CMNG=0,757,0,"-----BEGIN CERTIFICATE-----
...
2022-02-23T07:48:28.607Z DEBUG modem >> -----END CERTIFICATE-----"
2022-02-23T07:48:28.808Z DEBUG modem << OK
2022-02-23T07:48:28.810Z INFO Updating client certificate...
2022-02-23T07:48:28.813Z DEBUG modem >> AT%CMNG=0,757,1,"-----BEGIN CERTIFICATE-----
...
2022-02-23T07:48:29.026Z DEBUG modem >> -----END CERTIFICATE-----"
2022-02-23T07:48:29.465Z DEBUG modem << OK
2022-02-23T07:48:29.467Z INFO Updating private key...
2022-02-23T07:48:29.468Z DEBUG modem >> AT%CMNG=0,757,2,"-----BEGIN EC PARAMETERS-----
2022-02-23T07:48:29.480Z DEBUG modem >> BggqhkjOPQMBBw==
2022-02-23T07:48:29.493Z DEBUG modem >> -----END EC PARAMETERS-----
2022-02-23T07:48:29.507Z DEBUG modem >> -----BEGIN EC PRIVATE KEY-----
...
2022-02-23T07:48:29.558Z DEBUG modem >> -----END EC PRIVATE KEY-----"
2022-02-23T07:48:31.051Z DEBUG modem << OK
2022-02-23T07:48:31.052Z INFO Certificate update completed
2022-02-23T07:49:14.233Z DEBUG modem >> AT+CFUN?
2022-02-23T07:49:14.246Z DEBUG modem << +CFUN: 0
2022-02-23T07:49:14.266Z DEBUG modem << OK
2022-02-23T07:49:21.325Z DEBUG modem >> AT+CEREG=5
2022-02-23T07:49:21.337Z DEBUG modem << OK
2022-02-23T07:49:25.810Z DEBUG modem >> AT+CFUN=1
2022-02-23T07:49:25.852Z DEBUG modem << OK
2022-02-23T07:49:27.750Z DEBUG modem << +CEREG: 2,"026F","00332521",7
2022-02-23T07:49:29.448Z DEBUG modem << +CEREG: 5,"026F","00332521",7,,,"00011110","11100000"
2022-02-23T07:50:30.354Z DEBUG modem >> AT#XMQTTCON=1,"test_name","","","test_name.amazonaws.com",8883,757
2022-02-23T08:26:50.994Z DEBUG modem << ERROR

However, when using "RSA PRIVATE KEY" there are no problems, the broker responds, the ping passes correctly.

2022-02-22T16:14:46.286Z ERROR Error: 'AT#XMQTTCON=1,"test_name","","","test_name.amazonaws.com",8883,321
2022-02-22T16:14:52.756Z DEBUG modem << OK
2022-02-22T16:14:53.108Z DEBUG modem << #XMQTTEVT: 0,0
2022-02-22T16:15:10.692Z DEBUG modem << +CEREG: 5,"026F","00332521",7,,,"00011110","11100000"
2022-02-22T16:15:53.542Z DEBUG modem << #XMQTTEVT: 9,0
2022-02-22T16:16:53.257Z DEBUG modem << #XMQTTEVT: 9,0

[Øyvind]

Hello, 

Can it be due to an issue with certificate size? From the modem FW 1.3.1 release notes:

• - TLS/DTLS
  
  • Up to three simultaneous TLS/DTLS connections are possible.
  • Maximum server certificate chain size has a limit of 4kB.
  • Server certificate expiry time is not verified.
  • pkcs#8 is not supported.
  • Absolute maximum number of supported credentials is 32. The actual amount depends on size of credentials as memory area reserved for credentials may be a limiting factor as well.
  • DTLS supports PSK authentication only.
  • 2kB secure socket buffer size.
    
    

Are you trying to connect to Amazon AWS? If so, please follow the steps provided in our AWS IoT documentation in regards to certificates.

Kind regards,
Øyvind