Other Parts Discussed in Thread: UNIFLASH
Tool/software:
Hi,
I'm trying to establish a secure MQTT connection between TI's CC3220SF Launchpad and an AWS IoT Core broker. I've already followed most of the other threads relating to this issues, however, the solutions provided either don't work for me, or they seem to be dead ends.
I'm using the "mqtt_client_over_tls_1_3" demo project, TI-RTOS7, and SDK 7.10.00.13 as a base, and can't seem to get the secure connection to work.
I managed to get both an unsecure, as well as a secure connection working for mosquitto broker, which only uses a single certificate for verification, however AWS requires 3 files (root-CA.crt, client.cert.pem, private-key.private.key), and attempting to use them the same way doesn't seem to work.
Here are my current configurations and various things I've tried so far:
- AP_SSID and AP_PASSWORD set in "wifi_settings.h"
- using MQTT_QOS_0
- connection flags: MQTTCLIENT_NETCONN_URL | MQTTCLIENT_NETCONN_SEC | MQTTCLIENT_NETCONN_SKIP_CERTIFICATE_CATALOG_VERIFICATION
- port 8883
- flashing certificates using uniflash in userFiles (root directory)
- secure files: {"private-key.pem", "client-cert.cert.pem", "root-CA.pem", NULL}
using the above files in 'secure files', I get the following errors:
mbedtls_x509_crt_parse (remote root CA certificate):: root-CA.pem returned -8576
mbedtls_x509_crt_parse (local PEM certificate):: client-cert.cert.pem returned -8576
mbedtls_pk_parse_key (private key):: private-key.pem returned -15616
...
mbedtls SSL/TLS handshake failed..
...
connection failed: -3001
- I've also used the tried converting the certificates to .der files using the following commands:
openssl x509 -inform pem -in <CA_CERT_FILE_NAME> -outform der -out root-CA.der
openssl x509 -inform pem -in <CLIENT_CERT_FILE_NAME> -outform der -out client-cert.der
openssl pkcs8 -topk8 -in <PRIVATE_KEY_FILE_NAME> -inform pem -out private-key.der -outform der -nocrypt
Using the certificates in .der format, It now performs a successful SSL/TLS handshake and the certificate verification passes, however it gives me the following "mbedtls_ssl_read returned 0", followed by MQTT_EVENT-SERVER-DISCONNECT
- I've tested these certificates + private key with a test client called MQTT Explorer. I'm able to successfully connect and send/receive messages when using the certificates in their original format (.pem/.crt), however, connection fails when using them in .der format.
- AWS IoT Core thing is setup correctly and has policy attached.
- the policy itself is non restrictive, its set to accept all: { ..., "Action": "iot:*", "Resource": "*", ...}
- I have AWS cloudwatch logs setup for IoT Core and some logs shows that it does manage to connect, giving the following info:
{...., "status": "Success", "eventType": "Connect", "protocol": "MQTT", "clientId": "iotconsole-....", .... }
Despite the connection, it fails to send any messages through, and seems to disconnect right after.
From what I've gathered, I think the certificates are being parsed incorrectly, leading to a failed connection. If I attempt connection using .pem/.crt formats, it fails to parse the certificates, and if I use .der format, it gives me a mbed_ssl_read() returns 0 (which is when the peer/AWS closes the connection??).
Any help would be appreciated.
