Dear Yu-wen Tang,

I can connect to MQTT broker successfully thank to your awesome support. Now I have another problem that need your help. 

I try to connect PLC S7-1500 to secured mosquitto broker via TLS. The broker is created on my virtual ubuntu via port 8883. In window 10, I use MQTTfx and connect successfully to this broker by its mqtt_server.crt file. But when I use TIA Portal to connect, it fails and always show error code 8089.

Consult the manual, I recheck my project and make sure that S7-1500 firmware is over 2.0 (v2.5), the broker is OK. But the manual says that I must change the PLC time of day according to broker time of day, I am not sure about that. I think the problem caused by certificates in TIA PORTAL. Would you mind taking a look on my attached file and helping me to solve this problem? 

------------------------------------------------------------------------------------------
Split from MQTT Client Application Example for SIMATIC S7-1500.

Dear minhkhanh,
The following text is extracted from the manual of "MQTT Publisher for SIMATIC S7-1500" of Siemens Industry Online Support:
"The CPU's time of day has been set to the current time. A certificate always contains a validity period during which the certificate is valid. To be able to encrypt via the certificate, the S7-CPU’s time of day also needs to be within this validity period. On a brand-new S7-CPU or after fully resetting the S7-CPU, the internal clock is set to a default value that is outside the validity period of the certificate. The certificate is then marked as invalid."
In your pdf, I didn't see your CPU's time, but only time zone.
Could you please check your CPU's time first?

Best regards,
Yu-wen

Hi Yu-wen Tang,

I checked and make sure that time on PLC and broker is the same. I try some methods but no effect. One of the methods is using your MQTT client library. The result is the same and I get more errors (8089 certainly). I don't know why it doesn't work. Please give me some suggestions. Thank you so much!

Dear minhkhanh,

I also think that the cause might be the certificate.

I attach here the project which has successfully connected to test.mosquitto.org via secure connection (port 8884). You can do a cross-check of the security setting with the yours. It just follows the steps described in the pages 14-20 of the document "MQTTPublisher for SIMATIC S7-1500" of Siemens Industry Online Support. The mosquitto certificate is attached also.

The global security setting of the attached project:

User name: admin

Password: 12345678

Best regards,

Yu-wen

Dear Yu-wen Tang,

I hope you can help me to understand your idb_MQTT_Client.

My Problem is I can’t hold the Connection after I use the ssl-Functions.

I created my certificate with openssl.

I create the sameCertificate like you did for your cryption (mosquitto.org.cer).

(Hashes: SHA1, Key-Size: 1024 Bits rsa).

I use a local Mosquitto Broker. When I try to Sub/Pub messages that use my client certificates (ca.crt) like Mosquitto_Pub/Sub or Python Phao it works.

I can use your Client and Publish or Subscribe messages and that works too. Now I integrate my certificates (ca.crt) to TIA and want to connect to my Mosquitto Broker but it don’t works.

I get the Error Code = 80C4 „The connection cannot be established at the moment“.

I don’t know which parameters you used for following Values:

1. TLSServerReqClientCert
2. ExtTLSCapabilities
3. TLSServerCertRef
4. TLSClientCertRef
5. Can you tell me why you use your router in your Settings?

If you need any more details just write me back

Best wishes

Yadid Garbo

• Documentation of MQTT Publisher for SIMATIC CPU: 2.3 Configuration of the security function
• SIMATIC S7-1500, ET 200MP, ET 200SP, ET 200AL, ET 200pro Communication: 3.6 Secure communication

Hi Yu-wen Tang.

In this project, I used PLC s7-1200,S7-1500 and connected success with MQTT Broker at Local Area Network (LAN). However, when I changed the IP address of MQTT Broker (85.119.83.194:1883 -  mosquitto.org), the connection to the MQTT broker is not established and don't received error. I don't have static IP in LAN. Would you please show me the cause? Is the CP communication module necessary?
 I hope you answer for me. Thanks!