MQTT with TLS on AWS EC2

[flau]

Hi,

We have our own MQTT broker setup with TLS running on a AWS EC2 cloud service.  I am building my code based on the MQTT_SIMPLE example.  I have only a CA certificate in the certificates.h file.  There is no client private key and no client public certificate.  SEC_TAG is set to 2840.  Port is set to 8883.  Below is the terminal output.  IP address was resolved correctly.  Unfornately, I wasn't able to connect to our MQTT broker.  I kept getting error code 95.

[00:00:00.266,235] <inf> MQTT_SIMPLE: MQTT started
[00:00:00.271,270] <inf> MQTT_SIMPLE: Provisioning certificates
[00:00:00.428,375] <inf> MQTT_SIMPLE: Disabling PSM and eDRX
[00:00:00.439,147] <inf> MQTT_SIMPLE: LTE Link Connecting
[00:00:15.602,569] <inf> MQTT_SIMPLE: LTE Link Connected
[00:00:17.040,008] <inf> MQTT_SIMPLE: IPv4 Address found xxx.xxx.215.238
[00:00:17.047,363] <inf> MQTT_SIMPLE: TLS enabled
[00:00:17.707,611] <err> MQTT_SIMPLE: mqtt_connect -95
[00:00:17.713,256] <inf> MQTT_SIMPLE: Reconnecting in 30 seconds
[00:00:48.585,479] <err> MQTT_SIMPLE: mqtt_connect -95
[00:00:48.591,125] <inf> MQTT_SIMPLE: Reconnecting in 30 seconds
[00:01:19.484,619] <err> MQTT_SIMPLE: mqtt_connect -95
[00:01:19.490,264] <inf> MQTT_SIMPLE: Reconnecting in 30 seconds

The same code was able to connect with test.mosquitto.org with its mosquitto.org.crt (PEM format) and port 8883.  Am I missing anything?  What have I done wrong?

By the way, I am using SDK 1.8.0.

[flau]

We put more log messages in the code (mainly in mqtt.c and mqtt_transport_socket_tls.c) and found that there is an error when calling the zsock_connect funcation.  After that an error when calling the mqtt_transport_connect function.  And finally the mqtt_connect -95 error.

[Didrik Rokhaug]

flau said:

Does Trace Collector v2 work on custom board, or nRF9160DK only? 

It should work for any boards that has a serial port.

flau said:

We put more log messages in the code (mainly in mqtt.c and mqtt_transport_socket_tls.c) and found that there is an error when calling the zsock_connect funcation.  After that an error when calling the mqtt_transport_connect function.  And finally the mqtt_connect -95 error.

Yes, that's where it comes from. But to know why, we need to inspect the traffic between the modem and the server.

[leo_nam]

Hello, I'm working with flau on this problem. 

nrf9160_error95_trace.pcapng This is the trace of the modem when it receives the 'mqtt_connect -95' error. 

And from the server side the broker outputs: 

OpenSSL Error: error:1408A0C1:SSL routines: ssl3_get_client_hello:no shared cipher

I ran another trace while connecting successfully to the broker using mosquitto_sub command on powershell and when looking at the trace I get a 'Server Hello' with Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d) which isn't supported based on https://www.nordicsemi.com/Products/nRF9160/Download#infotabs. 

I tried restarting the broker with a cipher that's available in both the mosquitto_sub and nrf modem cipher suite by adding 'ciphers ECDHE-ECDSA-AES128-SHA256' to the mosquitto.conf but then i got the no shared cipher message when using mosquitto_sub. I'm not really sure where to go from here. 

[Didrik Rokhaug]

leo_nam said:

I tried restarting the broker with a cipher that's available in both the mosquitto_sub and nrf modem cipher suite by adding 'ciphers ECDHE-ECDSA-AES128-SHA256' to the mosquitto.conf but then i got the no shared cipher message when using mosquitto_sub. I'm not really sure where to go from here

Were you able to connect to the broker with the nRF9160 after changing the cipher suite of the broker?

[leo_nam]

I was unable to connect to the broker with the nRF9160.