Hello, I use esp32, w5500 and sslclient lib, pubsub lib trying to connect to mqtt broker with ca.crt, client.crt and client.key. similar to test.mosquitto.org on port 8884 And no succeed yet. Would really appreciate any help. Thank you

Use to post code. The syntax highlighting, monospaced fonts, and lack of word wrap can help people read your code and see problems. SPOILER: it is especially true in this case For big blocks of text, use C++ raw strings. For example, the root cert would start like const char *root_ca = R"( -----BEGIN CERTIFICATE----- MIIEAzCCAuugAwIBAgIUBY1hlCGvdj4NhBXkZ/uLUZNILAwwDQYJKoZIhvcNAQEL BQAwgZAxCzAJBgNVBAYTAkdCMRcwFQYDVQQIDA5Vbml0ZWQgS2luZ2RvbTEOMAwG The lack of lack of quotes and \n again makes the code more readable, and it's a snap to simply copy and paste the text as a file. When debugging on ESP32, compile with Debug output. In the bottom half of the Tools menu are the board-specific options. Core Level Debug defaults to None; change it to Debug, and re-upload. Now that you've broken the rule "Never Post Passwords and Private Keys", you'll need to do a new Certificate Signing Request to get a new cert and key. OK, so with Debug enabled, with ArduinoMqttClient and NetworkClientSecure I see (wrapped here for readability) [E][ssl_client.cpp:36] _handle_error(): [start_ssl_client():282]: (-15616) PK - Invalid key tag or value That [E] indicates Error, which means with the least amount of debug output, Error, you would have seen this. More importantly, what does PK - Invalid key tag or value mean? Well, let's take a step back and try some basic diagnostics: are the client cert and key valid? Do they match? You probably have the original copies of the files downloaded, but you should take what is actually in your code. Maybe there was a copy&paste error. Here's where those raw strings would be handy, but you can still do it with what you have here, by stripping out the quotes and \n. With Linux (or WSL on Windows) you can use xsel, or pbpaste on a Mac; and openssl. First, for client_crt xsel --clipboard --output \ | egrep -o '[A-Za-z0-9 /=+-]+' | egrep '..+' > client.crt Copy the two-line command, paste it into the shell, but don't press Enter. Next copy the big string into the clipboard. Then press Enter in the shell. Repeat for client_key xsel --clipboard --output \ | egrep -o '[A-Za-z0-9 /=+-]+' | egrep '..+' > client.key Compare the modulus for both the public and private key. You will hash the values to make any differences obvious. $ openssl x509 -modulus -noout -in client.crt | openssl md5 MD5(stdin)= e4fc41599618c82eb887048e8fdb261d The private key uses rsa instead of x509 $ openssl rsa -modulus -noout -in client.key | openssl md5 Could not read private key from client.key MD5(stdin)= d41d8cd98f00b204e9800998ecf8427e Wait, there's an error. (That MD5 is not relevant; it's the hash of nothing; same as echo -n | openssl md5). Let's do an even more basic check. $ file client.crt client.crt: PEM certificate $ file client.key client.key: ASCII text That shouldn't be just ASCII text. Take a closer look at the file. Big hint: the problem is on the first line ----BEGIN RSA PRIVATE KEY----- There are only four hyphens on the left. There should be five. Fix the file and try again. $ file client.key client.key: PEM RSA private key $ openssl rsa -modulus -noout -in client.key | openssl md5 MD5(stdin)= e4fc41599618c82eb887048e8fdb261d OK, they match. Go back in the code Fix it const char *client_key = "-----BEGIN RSA PRIVATE KEY-----\n" Run it [D][ssl_client.cpp:322] ssl_starttls_handshake(): Protocol is TLSv1.2 Ciphersuite is TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 [D][ssl_client.cpp:324] ssl_starttls_handshake(): Record expansion is 29 You're connected to the MQTT broker! Debug messages for a successful TLS connection -- this one with mTLS on port 8884, but it doesn't say that -- and the output from the MQTT example I used (File > Examples > ArduinoMqttClient > WiFiSimpleSender)

thank you so much, really apreciate it :+1: :+1: :+1:

Need help on esp32 w5000 mqtt with ssl

Projects General Guidance

bintanghd June 19, 2024, 1:30pm 21

thank you so much, really apreciate it

Topic		Replies	Views
NodeMCU (ESP8266) MQTT TLS Programming	4	513	May 3, 2025
ESP32 https connection to REST API doesn't work Programming	7	2167	October 9, 2024
SSLClient SSL_ERROR Certificate is expired or not yet valid Programming	2	180	June 19, 2026
NetworkClientSecure.h ESP32 Universal Telegram Bot issue (NodeMCU ok But ESP32 NOT Compiling) Programming	28	633	March 4, 2026
Opta MQTT over port 8883 using a TLS cert for encryption Opta	12	2899	January 28, 2025

Need help on esp32 w5000 mqtt with ssl

Related topics