How to setup MQTT over SSL with ESP IDF

[LucAppelman]

Description

We are trying to setup ESP IDF to connect with the build in MQTT server of thingsboard. We have setup the certificates as suggested in the tutorial by thingsboard with self signed certicates https://thingsboard.io/docs/user-guide/ ... generation. We can connect using MQTT explorer on a windows machine. I expect we need to do a mutual on the ESP side but whatever we have tried so far we can't connect.

Code: Untitled.cpp Select all

esp_mqtt_client_config_t clientConfig = {

    .host = MQTT_HOST,

    .port = 8883,

    .client_id = NULL,

    .username = username,

    .disable_auto_reconnect = true,

    .user_context = context,

    .cert_pem = "-----BEGIN CERTIFICATE-----\n" // openssl command as suggested on ESP IDF

               "..."

               "-----END CERTIFICATE-----\0",

    .transport = MQTT_TRANSPORT_OVER_SSL,

    .skip_cert_common_name_check = true,

};

As mentioned above the ESP IDF suggests https://docs.espressif.com/projects/esp ... t.html#ssl getting the cert_pem option by getting this using the following command

Code: Untitled.bsh Select all

openssl s_client -showcerts -connect mqtt.eclipseprojects.io:8883 </dev/null 2>/dev/null|openssl x509 -outform PEM >mqtt_eclipse_org.pem

Of course the url here is replaced with our own. This certificate is then used as .cert_pem.

The error we are currently getting from ESP-MQTT is 0x8008 https://docs.espressif.com/projects/esp ... codes.html.

Environment

OS: Ubuntu + Docker
ThingsBoard: Latest (v3.3.4.1)
ESP-IDF: Stable (4.4.1)

Dockerfile (using a proxy for http(s)):

Code: Untitled.yml Select all

version: '3'



services:

  thingsboard:

    restart: unless-stopped

    image: thingsboard/tb-postgres

    environment:

      - TB_QUEUE_TYPE=in-memory

      - TZ=Europe/Amsterdam

      - MQTT_SSL_ENABLED=true

      - MQTT_SSL_CREDENTIALS_TYPE=PEM

      - MQTT_SSL_PEM_CERT=/certs/server.pem

      - MQTT_SSL_PEM_KEY=/certs/server_key.pem

      - MQTT_SSL_SKIP_VALIDITY_CHECK_FOR_CLIENT_CERT=true

    volumes:

      - type: bind

        source: ./thingsboard/data

        target: /data

      - type: bind

        source: ./thingsboard/logs

        target: /var/log/thingsboard

      - type: bind

        source: ./thingsboard/certs

        target: /certs

    ports:

      - 1883:1883

      - 8883:8883

      - 7070:7070

      - 5683-5688:5683-5688/udp

[chegewara]

There is one value wrong in mqtt config, but i am not 100% sure its the case. client_id cant be NULL.

[LucAppelman]

Unfortunately this was not a solution to our problem. Still receiving the same error.

In menuconfig we have CONFIG_MQTT_PROTOCOL_311 enabled. And we also enabled CONFIG_ESP_TLS_INSECURE and CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY.

[YJM]

The error 0x8008 is ESP_ERR_ESP_TLS_TCP_CLOSED_FIN. It seems the peer send FIN to close the connection. I have no idea why the server send FIN. You can use MQTT client tool to connect your server and compare with it.

[LucAppelman]

The error 0x8008 is ESP_ERR_ESP_TLS_TCP_CLOSED_FIN. It seems the peer send FIN to close the connection. I have no idea why the server send FIN. You can use MQTT client tool to connect your server and compare with it.

This is true! Unfortunately this was not documented on the error code page.

I had not noticed the mqtt-explorer client on our desktop also disconnected after a short amount of time when logged in with the account for provisioning because mqtt-explorer reconnects automatically.

After we had readded the log line that was removed when changing the MQTT_EVENT_DATA handler from the example it became clear that the connection closed a lot later then we received data, and then found out that the provision response was not processed.

Code: Select all

// we used
if (strcmp(topic, "/provision/response")) {}
// but we should have done
if (strcmp(topic, "/provision/response") == 0) {}

A simple C error, but hard to notice without proper debugging

Thanks for your response!