TLS Connection with Self Signed Certificate

[alaub81]

I tried and googled a lot and can't get it to work.
I try to connect to my Mosquitto MQTT Broker which speaks TLS with a self signed certificate. With python and paho mqtt I can connect with these tweaks:

• client.tls_set(cert_reqs=ssl.CERT_NONE)
• client.tls_insecure_set(insecure)

I tried same setting on connecting with umqtt.simple2:

client = MQTTClient(mqttclientid, <host>, port=8883, user=<mqttusername>,
                            password=<mqttpassword>, keepalive=30, ssl=True,
                            ssl_params={"cert_reqs":ssl.CERT_NONE})
client.connect()

I get the error:

Traceback (most recent call last):
  File "<stdin>", line 38, in <module>
  File "/lib/umqtt/simple2.py", line 67, in connect
  File "/lib/umqtt/simple2.py", line 19, in _read
  File "/lib/umqtt/simple2.py", line 47, in _sock_timeout
MQTTException: 30

Connecting without TLS to port 1883 is working fine.

Is it possible to connect without importing the SSL Certs on my Pico? I hope so.

Details (please complete the following information):

• Raspberry PI Pico w
• Micropython version: rp2-pico-w-20220914-unstable-v1.19.1-409

[fizista]

Are you sure this is a problem with the SSL certificate? "MQTTException: 30" error means "Connection timeout"

[alaub81]

I am not sure if, the problem is belonging to my certificate. But I know, that my Broker is available on Port 8883 with TLS enabled. I am using a self signed certificate.

If I am using the same script with port=1883 and ssl=False everything is working fine.

in the mosquito log file I can see these lines:

1663583861: New client connected from 192.168.50.246:60624 as pico-w-001 (p2, c1, k5, u'mosquitto').
1663583861: Sending CONNACK to pico-w-001 (0, 0)
1663583872: Client pico-w-001 has exceeded timeout, disconnecting.

[fizista]

There is a new version of the library in which encrypted connections work well on esp32 already.

I don't have rp2-pico, so it would be good for someone to test it to see if everything works there too already.

[alaub81]

There is a new version of the library in which encrypted connections work well on esp32 already.

I don't have rp2-pico, so it would be good for someone to test it to see if everything works there too already.

I can test it. Do you have a working configuration for me? So I can test it with the same parameters as it works on esp32.

cheers
Andreas

[ondrej1024]

I have a similar issue here. My MQTT broker doesn't require a client certificate and key file, only the CA file. From a PC, using the ca.pem file I can connect successfully to the broker.

So I convert the ca.pem file to DER format:

openssl x509 -outform der -in ca.pem -out ca.der

and put the ca.der file in the Micropython device (RPi Pico). Then I try to establish the MQTT connection:

from umqtt.simple2 import MQTTClient
import ussl

cadata = open('/res/ca.der','rb').read()
ssl_params = {'cert_reqs':ussl.CERT_REQUIRED,'cadata': cadata}
mqttc =  MQTTClient('rpipico', mybroker, port=8883, ssl=True, ssl_params=ssl_params)
mqttc.connect()

I can see the connection attempt on the broker, but it is not successfull.

I get this error on the RPi Pico:

Traceback (most recent call last):
  File "<stdin>", line 40, in <module>
  File "umqtt/simple2.py", line 267, in connect
OSError: [Errno 107] ENOTCONN

Could this be an issue with the SSL implementation or am I doing something wrong?

[fizista]

It is difficult for me to say what is causing the problem.

The SSL libraries used in the micropython code for ESP32 (mbedtls) and ESP8266 (axtls) are different.

The Raspberry pi pico port uses the mbedtls library, which works well in ESP32. Unfortunately, the Raspberry has half the RAM as the ESP32. Which could be a problem.

What I would check:

• checked with mosquitto_pub, mosquitto_sub commands to see if we can connect via SSL.
• then I would manually try to establish an SSL connection using ssl.wrap_socket (https://docs.micropython.org/en/latest/library/ssl.html?highlight=ssl), if it fails, the problem would be in the micropython code

[ondrej1024]

Thanks for the suggestions.

Connecting to the broker via SSL with mosquitto_pub works fine.
Now I will try and use ssl.wrap_socket() on the Pico to see if I can get any clue what the problem is.

[ondrej1024]

I tried the original umqtt.simple package and the exact same code works fine with it.

[ec6412]

I wanted to use umqtt.robust, which requires umqtt.simple2 to work. I got a similar issue as @ondrej1024 with the ENOTCONN using simple2 (where umqtt.simple works fine, like what @ondrej1024 experienced). When I modified the simple2 connect() method to remove the self.sock_raw.setblocking(True) before the ussl.wrap_socket(....), it connects fine. But I don't know why this works.

        if self.ssl:
            import ussl
            # self.sock_raw.setblocking(True)
            self.sock = ussl.wrap_socket(self.sock_raw, **self.ssl_params)
            # self.sock_raw.setblocking(False)
        else:
            self.sock = self.sock_raw

This change basically matches what umqtt.simple does for this if statement.