MQTT TLS error on EXS82-W | Telit Cinterion IoT Developer Community
April 22, 2021 - 4:46pm, 4867 views
I have configured a Mosquitto server on my local machine:
mosquitto -h
mosquitto version 2.0.10
mosquitto is an MQTT v5.0/v3.1.1/v3.1 broker.
Usage: mosquitto [-c config_file] [-d] [-h] [-p port]
-c : specify the broker config file.
-d : put the broker into the background after starting.
-h : display this help.
-p : start the broker listening on the specified port.
Not recommended in conjunction with the -c option.
-v : verbose mode - enable all logging types. This overrides
any logging options given in the config file.
See https://mosquitto.org/ for more information.
Here is the configuration file I am using:
allow_anonymous false
listener 8883 0.0.0.0
cafile /home/user/CERTS/ca.crt
certfile /home/user/CERTS/server.crt
keyfile /home/user/CERTS/server.key
tls_version tlsv1.2
require_certificate true
use_identity_as_username true
I am trying to use the MQTT with TLS, and with this configuration, I am able to subscribe and publish like this:
mosquitto_sub --cafile ca.crt -h AAAA.BBBB.CCCC.DDDD -t "mqtttest" -p 8883 -d --cert client.crt --key client.key
mosquitto_pub -h AAAA.BBBB.CCCC.DDDD -t "mqtttest" -m "***** world!" -p 8883 -d --cert client.crt --key client.key --cafile ca.crt
Obs.: AAAA.BBBB.CCCC.DDDD
is just to hide my public IP, but I have already tested that my Mosquitto is accessible in an outside network (my IP is publicly accessible).
Up to this point, everything is working as I expected, where I can connect locally and outside my network.
The problem is when I try to connect it with a Cinterion module, which supports specification OASIS MQTT Version 3.1.1.
Also, the Cinterion module EXS82-W is using TLS version 1.2, which is the same as the Mosquitto.
However, when I try to connect the Cinterion module I get this error:
1619097715: New connection from AAAA.BBBB.CCCC.DDDD:1234 on port 8883.
1619097717: OpenSSL Error[0]: error:141A20F4:SSL routines:ossl_statem_server_read_transition:unexpected message
1619097717: Client <unknown> disconnected: Protocol error.
I do not know what is wrong here.
If I comment from the config file these two attributes:
# require_certificate true
# use_identity_as_username true
Then clients do not connect anymore, and I get this error (when trying to connect via mosquitto_sub
):
mosquitto_sub --cafile ca.crt -h AAAA.BBBB.CCCC.DDDD -t "mqtttest" -p 8883 -d --cert client.crt --key client.key
Client (null) sending CONNECT
Client (null) received CONNACK (5)
Connection error: Connection Refused: not authorised.
Client (null) sending DISCONNECT
And, if I try to connect with the Cinterion module, I get this:
1619101865: New connection from AAAA.BBBB.CCCC.DDDD:1234 on port 8883.
1619101866: OpenSSL Error[0]: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired
1619101866: Client <unknown> closed its connection.
Osb.: I had followed this tutorial on how to configure MQTT to use TLS communication, which is the steps that have worked so far for me.
My system is Ubuntu 20.04, kernel 5.4.0-72-generic
Cinterion module: EXS82-W B2.1
Mosquitto Server 2.0.10
TLS version used: 1.2
Running ATI1 on module:
Terminal ready
ATI1
Cinterion
EXS82-W
REVISION 01.100
A-REVISION 01.000.14
OK
For these tests, I am using the MQTT example from the SDK, which I had to just update the IP of the MQTT Server, and the certificates for the new ones I had generated.
Hello,
Have you seen this https://iot-developer.thalesgroup.com/showcase/mqtts-demo-using-embedded...
Is your MQTT example same?
Do you have any logs from the module side?
Have you tried with any public MQTT test server?
You could also try with AT commands for reference.
Best regards,
Bartłomiej
Hello,
Thanks for the shared codes.
However, I am still not able to connect.
Considering that I copied all the files you mentioned to the SDK/examples/mqtt, accordingly.
These were the steps I executed with the code you provided:
1 - Download the certificates using the SDK
2 - Verify the mqtt.c file, and change the required items, such as APN.
For this, the changes I have made were just the APN on line 140, and APN username and password, at lines 141, and 142, respectively.
I didn't change the username_ptr neither password_ptr in the mqtt configuration (lines 145 ~ 148). I assume that the MQTT server on Thales side is configured for that.
The mqtt_server_ip is the same as in the file, 123.56.73.138 (line 162).
Also, the "#define ENABLE_SSL_MQTT" is set, thus, the mqtts will be used.
I also added some extra debug messages, just to enrich the debugging messages to identify what could be the cause of the connection not happening.
3 - Compile the example:
4 - Download the compiled example to the module:
5 - Here is the AT commands to prove that the module has a connection with the internet (sensitive data I changed to " ****** ") :
6 - Then, I started the application:
7 - And connected the logger to see the debug messages:
I also tested to connect to THALES via mosquitto_sub / mosquitto_pub clients, using these very same certificates, and I could succeed, below the logs:
Subscriber:
Publisher:
As you can see, the publisher published on "mqttwill" successfully, and the subscriber received it successfully.
UPDATE:
There are these other AT commands that I've tried as well.
Please, notice that for these commands, there is a "Certificate format error" message at the end, as well as "AT^SIND=is_cert,1" does not show any certificate.
The unsecure connection works fine.
I just disable the "ENABLE_SSL_MQTT" on mqtt.c file, and here are the logs:
And, I also connected the mosquitto_sub to see the messages comming, and here are the logs:
Hello Bartłomiej , are these informations good for you to check if I am doing something wrong?
Thanks.
Hello,
Thank you for all the information. Unfortunately I don't have experience with this topic and had to ask a college for advice. I hope to hear from him soon.
Best regards,
Bartłomiej
Hello,
To help further on debugging, I added some more verifications on the code based on the return codes that have been happening.
If you take a loop at the end of the logs below, it is telling that the TCP bind failed "QAPI_NET_MQTT_ERR_TCP_BIND_FAILED".
Hello,
I could succeed now to fix the problem.
To summarize, I have changed these parameters:
Here is the complete paste of the code, it contains some extra debug messages, but replacing to this code, works fine:
Hello,
Thank you for the update. I didn't get any hints from my college yet. So it's a good news that the problem is solved already.
Best regards,
Bartłomiej