Dear all,

I have a problem regarding MQTT certificate in TIA Portal. The MQTT broker I'm using requires ClientPrivate.key to allow connection, but TIA Portal does not permit to add this file type to Certificate Manager. Moreover, MQTT library published by Siemens has no parameters to assign client key file. I don't know how to solve it. Please help me!

Hello,

please read the notes in the document you find under

Documentation and project example for an secure messaging (S7-1500)

on the MQTT entry page.

https://support.industry.siemens.com/cs/de/en/view/109748872

Especially page 18 and 21

Pittiplatsch

Hello,

please read the notes in the document you find under

Documentation and project example for an secure messaging (S7-1500)

on the MQTT entry page.

https://support.industry.siemens.com/cs/de/en/view/109748872

Especially page 18 and 21

 Thank Pittiplatsch for you reply. My actual problem is to combine the Client.key and Client.pem to a single file (Client.p12) to import to Global Certificate Manager (TIA Portal). I've tried some methods on the internet, but it does not work (MQTT FB shows certificate error code). Please give me some recommendations. Thank you

Yu-wen Tang

Dear minhkhanh,
If the MQTT FB shows a certificate error code, I think the problem should come from the MQTT broker side.
If you are connecting to AWS IoT, make sure that you have registered your CA Certificate. Please follow the instruction of AWS IoT - Use Your Own Certificate or contact with AWS Support for help.
Best regards,
Yu-wen

 Dear Yu-wen Tang,

Thank you for your reply.

I'm sure that all certificates are OK (as I can connect to AWS via MQTT.fx application by using these certificates). The problem is combination private key and client certificate.

Have you ever worked with AWS, Tang? 

Dear minhkhanh,
After creating the certificate from AWS IoT, you should get 3 files: .pem, .crt and .key. Generate a .p12 file using OpenSSL with the .crt and .key. In the TIA Portal Certificate manager, import the .pem into Certificate authority (CA), and the .p12 into Device certificates. In the MQTT FB, set the port to 8883. Rebuild All hardware and software, download and try. Make sure that your PLC's module time is current.
Best regards,
Yu-wen

Yu-wen Tang

Dear minhkhanh,
After creating the certificate from AWS IoT, you should get 3 files: .pem, .crt and .key. Generate a .p12 file using OpenSSL with the .crt and .key. In the TIA Portal Certificate manager, import the .pem into Certificate authority (CA), and the .p12 into Device certificates. In the MQTT FB, set the port to 8883. Rebuild All hardware and software, download and try. Make sure that your PLC's module time is current.
Best regards,
Yu-wen

 Thank you for your sharing. I'll try it later

@minhkhanh: Did you got the certificates working? Are you using the "official" LMqtt_Publisher in your S7 application ? Do you use the LMqttQdn FB for secure messaging? Does the LMqttQdn require the usage of a DNS-Server ? How did you configured the remote_qdn input parameter?

Hello, I'm facing the same problem, and I tried everything until here, could you please help me to configure the certificates properly?

Thanks in Advance