Skip to Content

Register Login

Industry Online Support

Technical Forum

Navigation

Mosquitto MQTT SSL

Created by: M4RC at: 6/7/2021 5:01 PM (6 Replies)

Rating (0)

Thanks 3

7 Entries

6/7/2021 5:01 PM	Rate (0)
M4RC Advanced Member Joined: 1/27/2020 Last visit: 9/27/2021 Posts: 14 Rating: (0)	Hi guys, I would like to use my IOT2050 to establish an SSL connection via MQTT with a PLC. In Node-Red I have already used the aedes broker, but even there I could not create certificates for an SSL connection and would like to realize the whole thing directly with Mosquitto. For the PLC I do not need any further information. I have already created different certificates (see attachment) with commands like "openssl genrsa -des3 -out ca.key 2048" on the IOT2050. I now need help with the mosquitto.conf and the MQTT-Node. Here is my flow in node red: Flow [{"id":"23c54782.6bf42","type":"tab","label":"Flow 1","disabled":false,"info":""},{"id":"7a9e5916.4d8128","type":"mqtt out","z":"23c54782.6bf42","name":"test1","topic":"test1","qos":"2","retain":"","broker":"89066979.48bc98","x":330,"y":380,"wires":[]},{"id":"95277020.5934e8","type":"inject","z":"23c54782.6bf42","name":"","props":[{"p":"payload"}],"repeat":"30","crontab":"","once":false,"onceDelay":0.1,"topic":"","payload":"","payloadType":"str","x":200,"y":300,"wires":[["43d58086.947828"]]},{"id":"43d58086.947828","type":"function","z":"23c54782.6bf42","name":"","func":"var now = new Date().toLocaleString(\"de-DE\");\nmsg.topic = \"test1\";\nmsg.payload = now;\n\nreturn msg;","outputs":1,"noerr":0,"initialize":"","finalize":"","x":260,"y":340,"wires":[["7a9e5916.4d8128","fef230a0.c05858"]]},{"id":"fef230a0.c05858","type":"debug","z":"23c54782.6bf42","name":"","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"payload","targetType":"msg","statusVal":"","statusType":"auto","x":430,"y":320,"wires":[]},{"id":"6ecf9057.98118","type":"comment","z":"23c54782.6bf42","name":"MQTT Timestring injizieren","info":"Auf MQTT-Broker wird Timestring injiziert\nTopic: test1\nPayload: MM/DD/YYYY, HH:MM:SS","x":190,"y":260,"wires":[]},{"id":"428d339f.87b8ec","type":"mqtt in","z":"23c54782.6bf42","name":"MQTT Alles","topic":"#","qos":"2","datatype":"auto","broker":"7692a136.c7b528","x":730,"y":300,"wires":[["27a15856.f74898"]]},{"id":"27a15856.f74898","type":"debug","z":"23c54782.6bf42","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"false","statusVal":"","statusType":"auto","x":920,"y":300,"wires":[]},{"id":"16866e94.cecfd1","type":"comment","z":"23c54782.6bf42","name":"MQTT alle Variablen anzeigen","info":"","x":780,"y":260,"wires":[]},{"id":"89066979.48bc98","type":"mqtt-broker","name":"","broker":"localhost","port":"8883","tls":"13af2193.a09426","clientid":"sempatest","usetls":true,"compatmode":false,"keepalive":"60","cleansession":true,"birthTopic":"","birthQos":"0","birthPayload":"","closeTopic":"","closeQos":"0","closePayload":"","willTopic":"","willQos":"0","willPayload":""},{"id":"7692a136.c7b528","type":"mqtt-broker","name":"","broker":"localhost","port":"1883","tls":"13af2193.a09426","clientid":"","usetls":false,"compatmode":false,"keepalive":"60","cleansession":true,"birthTopic":"","birthQos":"0","birthPayload":"","closeTopic":"","closeQos":"0","closePayload":"","willTopic":"","willQos":"0","willPayload":""},{"id":"13af2193.a09426","type":"tls-config","name":"IOT2050","cert":"/etc/mosquitto/Zertifikate/client.crt","key":"/etc/mosquitto/Zertifikate/client.key","ca":"/etc/mosquitto/ca_certificates/ca.crt","certname":"client.crt","keyname":"client.key","caname":"ca.crt","servername":"testsempa","verifyservercert":true}] Mosquitto.conf mosquitto.conf # A full description of the configuration file is at # /usr/share/doc/mosquitto/examples/mosquitto.conf.example pid_file /var/run/mosquitto.pid persistence true persistence_location /var/lib/mosquitto/ log_dest file /var/log/mosquitto/mosquitto.log include_dir /etc/mosquitto/conf.d #normaler unverschlüsselter Port #listener 1883 #verschlüsselter Port port 8883 #Nur Zertifikate mit diesem CA-File cafile /etc/mosquitto/ca_certificates/ca.crt certfile /etc/mosquitto/certs/server.crt keyfile /etc/mosquitto/certs/server.key #Nur Clients mit Zertifikat require_certificate true tls_version tlsv1 #use_identity_as_username true #Security allow_anonymous false password_file /etc/mosquitto/passwd I hope you can do something with the given information or have an alternative guide for me. [EDIT:] Mosquitto.log says: "New connection from 127.0.0.1 on port 8883." "Socket error on client <unknown>, disconnecting." The exact problem is that I have no connection between broker and clients since trying to use SSL encryption. I don't know where exactly the problem is. So with my certificates or the location of the certificates or configurations in Node-Red etc? [/EDIT] Many greetings Marc Attachment Zertifikate.JPG (220 Downloads)
	Last edited by: M4RC at: 06/08/2021 10:41:10 more details
Suggestion To thank Quote Answer

6/9/2021 10:53 AM	Rate (0)
bergmanu Platinum Expert Joined: 4/28/2015 Last visit: 12/5/2023 Posts: 3297 Rating: (369)	Hi, just to make sure I understood your use case correctly: You have MQTT publisher/subscriber blocks on your PLC and the MQTT broker shall be the mosquitto on the IOT2050? This connection shall be secured via SSL and now the problem is that you don't know how to deal with the SSL certificates on the IOT2050 (MQTT broker) side? Best regards!

Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users M4RC

6/9/2021 11:21 AM	Rate (0)
M4RC Advanced Member Joined: 1/27/2020 Last visit: 9/27/2021 Posts: 14 Rating: (0)	Hello, this is correct. I was already able to connect successfully without SSL certificate. Unfortunately, a connection with SSL certificate does not work. It is quite possible that I only made a mistake with the certificates, because the certificates for server (broker) and client are based on the CA (certificate Authority). I have already used several instructions, however none of them works. There is an example in the attachment. Attachment dev.to_create-sign-ssl-tsl.JPG (231 Downloads)

Suggestion To thank Quote Answer

6/11/2021 8:26 AM	Rate (0)
bergmanu Platinum Expert Joined: 4/28/2015 Last visit: 12/5/2023 Posts: 3297 Rating: (369)	Hi, since you are not sure whether the certificates are created correctly, I can suggest to use this tool to create the certs (CA, client and server). There is a GUI and it is easy to use. After you need to place this files poperly in the mosquitto.conf. I am not sure how this exactly looks, but I guess your config looks not bad. Did you also place the certificate to the TIA Portal / PLC as described in the MQTT application example documentation? I will try to test this today, hopefully I can find the time. Best regards!

Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users M4RC

6/11/2021 11:16 AM	Rate (0)
M4RC Advanced Member Joined: 1/27/2020 Last visit: 9/27/2021 Posts: 14 Rating: (0)	Hello, this tool worked perfectly! I think my certificates before were not configured correctly. With the software I created the certificate in .crt format for CA, server and clients. And exported the private keys in .pem format for server and clients. The PLC needs a Certificate in pfx-format. In Mosquitto I still adjusted the default.conf: default.conf #unencrypted port #listener 1883 localhost #encrypted Port port 8883 #only certs of CA-File cafile /etc/mosquitto/ca_certificates/CA.crt certfile /etc/mosquitto/certs/SERVER.crt keyfile /etc/mosquitto/certs/SERVER.pem #only clients of this ca require_certificate true #tls_version tlsv1 #use_identity_as_username true #Security allow_anonymous false password_file /etc/mosquitto/passwd Best regards Marc
	Last edited by: M4RC at: 06/14/2021 08:21:38 commented out "tlsv1" Last edited by: M4RC at: 06/14/2021 09:32:47
Suggestion To thank Quote Answer

6/11/2021 11:41 AM	Rate (0)
bergmanu Platinum Expert Joined: 4/28/2015 Last visit: 12/5/2023 Posts: 3297 Rating: (369)	Hi, means your connection works now with SSL encryption? Best regards!

Suggestion To thank Quote Answer

6/14/2021 8:31 AM	Rate (0)
M4RC Advanced Member Joined: 1/27/2020 Last visit: 9/27/2021 Posts: 14 Rating: (0)	Hello, yes everything works. Also the user authentication works. I tested the connection only with Node-Red in the beginning. For the connection with the PLC I had to change a line in the default.conf. The PLC needs a client.pfx device certificate, still changing the file extension to .p12 and the CA.crt as CA certificate. Best regards Marc

Suggestion To thank Quote Answer
This contribution was helpful to 1 thankful Users bergmanu

|

Share this page:

Share this page on...

Follow us on