Thanks. I've had a chance to look at that thread now and it seems focused on the client.setMutualAuthParams(mTLS); part which I think I have set ok. I think that, in part, because I am getting a very different error. The error I have is about the trust auhtority.
I am using a self-signed certificate, not a commercial certificate. So I am probably not converting the CA.crt (the certificate authority cert) and server.crt (the MQTT server's own certificate) files properly. I could certainly use more ideas about how to get both of those into the right format so they can be used by the SSLClient library. The library Example sketch shows three places marked // FIX ME but I am puzzled as to precisely what to put there in the three variables.
Here is the current error message:
You're connected to the network
Attempting MQTT connection...(SSLClient)(SSL_WARN)(m_run_until): Terminating because the ssl engine closed
(SSLClient)(SSL_ERROR)(m_start_ssl): Failed to initlalize the SSL layer
(SSLClient)(SSL_ERROR)(m_print_br_error): Expected server name was not found in the chain.
from this sketch:
/*
Basic MQTT example (with SSL!)
This sketch demonstrates the basic capabilities of the library.
It connects to an MQTT server then:
- publishes "hello world" to the topic "outTopic"
- subscribes to the topic "inTopic", printing out any messages
it receives. NB - it assumes the received payloads are strings not binary
It will reconnect to the server if the connection is lost using a blocking
reconnect function. See the 'mqtt_reconnect_nonblocking' example for how to
achieve the same result without blocking the main loop.
You will need to populate "certificates.h" with your trust anchors
(see https://github.com/OPEnSLab-OSU/SSLClient/blob/master/TrustAnchors.md)
and my_cert/my_key with your certificate/private key pair
(see https://github.com/OPEnSLab-OSU/SSLClient#mtls).
*/
#include <SPI.h>
#include <WiFi101.h> // https://www.arduino.cc/en/Reference/WiFi101
#include <SSLClient.h> // https://github.com/OPEnSLab-OSU/SSLClient
#include <PubSubClient.h> // https://pubsubclient.knolleary.net/api
#include "certificates.h" // This file must be regenerated
#include "arduino_secrets.h" // network connection data in arduino_secrets.h
char ssid[] = SECRET_SSID; // network SSID
char pass[] = SECRET_PASS; // network password
int status = WL_IDLE_STATUS; // the WiFi radio's status
SSLClientParameters mTLS = SSLClientParameters::fromPEM(my_cert, sizeof my_cert, my_key, sizeof my_key);
byte mac[] = { 0xDE, 0xED, 0xBA, 0xFE, 0xFE, 0xED };
void callback(char* topic, byte* payload, unsigned int length) {
Serial.print("Message arrived [");
Serial.print(topic);
Serial.print("] ");
for (int i = 0; i < length; i++) {
Serial.print((char)payload[i]);
}
Serial.println();
}
// EthernetClient ethClient;
WiFiClient wifiClient;
SSLClient wifiClientSSL(wifiClient, TAs, (size_t)TAs_NUM, A5);
PubSubClient mqttclient(mqttServer, 8883, callback, wifiClientSSL);
void reconnect() {
// Loop until we're reconnected
while (!mqttclient.connected()) {
Serial.print("Attempting MQTT connection...");
// Attempt to connect
if (mqttclient.connect("arduinoClient", MQTT_ACCT, MQTT_PASS)) {
Serial.println("connected");
// Once connected, publish an announcement...
mqttclient.publish("outTopic", "hello world");
// This is a workaround to address https://github.com/OPEnSLab-OSU/SSLClient/issues/9
wifiClientSSL.flush();
// ... and resubscribe
mqttclient.subscribe("inTopic");
// This is a workaround to address https://github.com/OPEnSLab-OSU/SSLClient/issues/9
wifiClientSSL.flush();
} else {
Serial.print("failed, rc=");
Serial.print(mqttclient.state());
Serial.println(" try again in 5 seconds");
// Wait 5 seconds before retrying
delay(5000);
}
}
}
void setup() {
// Start Serial
Serial.begin(115200);
while (!Serial);
// Enable mutual TLS with SSLClient
//ethClientSSL.setMutualAuthParams(mTLS);
wifiClientSSL.setMutualAuthParams(mTLS);
// You can use Ethernet.init(pin) to configure the CS pin
if (WiFi.status() == WL_NO_SHIELD) {
Serial.println("WiFi shield not present");
// don't continue:
while (true);
}
// attempt to connect to WiFi network:
while ( status != WL_CONNECTED) {
Serial.print("Attempting to connect to WPA SSID: ");
Serial.println(ssid);
// Connect to WPA/WPA2 network:
status = WiFi.begin(ssid, pass);
// wait 5 seconds for connection:
delay(5000);
}
Serial.println("You're connected to the network");
}
void loop() {
if (!mqttclient.connected()) {
reconnect();
}
mqttclient.loop();
}
and here is the certificates.h file (with abbreviated data):
#ifndef _CERTIFICATES_H_
#define _CERTIFICATES_H_
#ifdef __cplusplus
extern "C"
{
#endif
/* You will need to generate the information in this file manually
using pycert_bearssl. For more information, please see
https://github.com/OPEnSLab-OSU/SSLClient/blob/master/TrustAnchors.md
*/
const char my_cert[] = "-----BEGIN CERTIFICATE-----\n\
MIIC/TCCAeUCFDgSCNPj6HFzyoqxmzmLoL14ORNdMA0GCSqGSIb3DQEBCwUAMDsx\n\
...
PmXbA913XcEBUmqLRTmb+F4/asqO/jv6kGObFgF9Br+bEASRGwZwRrYZhXCTbVgd\n\
kg==\n\
-----END CERTIFICATE-----";
const char my_key[] = "-----BEGIN RSA PRIVATE KEY-----\n\
MIIEowIBAAKCAQEA1Wnb6coeB2lvVk/IH14AqLNIzKffIKCGFPIbpA6JUDRLOyzI\n\
...
Bhb+NUPFJEOHTjBlT8auEUi23xSo9Q/6g+pHQprMHXtNzeujnnVftI+KIDOvJd8y\n\
uy+yivfHWDwgISrS0MET6pGSUg1+/ubfoNSn0IhJWOz+CLe0Ae8I\n\
-----END RSA PRIVATE KEY-----";
#define TAs_NUM 1
static const unsigned char TA_DN0[] = {
// FIXME
0x30, 0x82, 0x03, 0x57, 0x30, 0x82, 0x02, 0x3F, 0xA0, 0x03, 0x02, 0x01,
...
0x38, 0x52, 0xA9, 0xB1, 0xE3, 0x78, 0xB8, 0xFA, 0x5A, 0x87, 0x68, 0x70,
0xE7, 0x1F, 0xF8, 0x69, 0x05, 0x4C, 0x33
};
static const unsigned char TA_RSA_N0[] = {
// FIXME
0x30, 0x82, 0x03, 0x17, 0x30, 0x82, 0x01, 0xFF, 0xA0, 0x03, 0x02, 0x01,
0x02, 0x02, 0x14, 0x38, 0x12, 0x08, 0xD3, 0xE3, 0xE8, 0x71, 0x73, 0xCA,
...
0x84, 0x3C, 0x0E, 0x53, 0xD4, 0xDF, 0xBA, 0x10, 0xFF, 0xA6, 0xFF, 0x0F,
0x87, 0x6D, 0x7B
};
static const unsigned char TA_RSA_E0[] = {
// FIXME
0x01, 0x00, 0x01,
};
static const br_x509_trust_anchor TAs[] = {
{
{ (unsigned char *)TA_DN0, sizeof TA_DN0 },
BR_X509_TA_CA,
{
BR_KEYTYPE_RSA,
{ .rsa = {
(unsigned char *)TA_RSA_N0, sizeof TA_RSA_N0,
(unsigned char *)TA_RSA_E0, sizeof TA_RSA_E0,
}
}
}
},
};
#ifdef __cplusplus
} /* extern "C" */
#endif
#endif /* ifndef _CERTIFICATES_H_ */