MQTT Secure Connection Over TLS

MQTT secure connection over TLS
MQTT: Message Queuing Telemetry Transport Protocol

MQTT (MQ Telemetry Transport) is a lightweight open messaging protocol that provides
resource-constrained network clients with a simple way to distribute telemetry information
in low-bandwidth environments. The protocol, which employs a publish/subscribe
communication pattern, is used for machine-to-machine (M2M) communication.
MQTT architecture
Types of MQTT messages

An MQTT session is divided into four stages: connection, authentication,
communication and termination. A client starts by creating a Transmission
Control Protocol/Internet Protocol (TCP/IP) connection to the broker by using
either a standard port or a custom port defined by the broker's operators.
The standard ports are 1883 for nonencrypted communication and 8883 for
encrypted communication -- using Secure Sockets Layer (SSL)/Transport Layer
Security (TLS).
1
MQTT Stack without security layer
MQTT Stack with security layer
To assure a secure communication we need to create differents types of keys

which are :
private key :Key
public key: Certfication
certificate authority
2
Configuration of MQTT broker and MQTT client to use TLS security:
We will be using openssl to create our own Certificate authority (CA), Server keys and
certificates.
The steps covered here will create an encrypted connection between the MQTT broker and
the MQTT clients.
Shell Script To Create Self-Signed Certificate

You just need to execute the script with the domain name or IP that you want to add to the
certificate.
1. Save the following shell script as ssl.sh
#! /bin/bash
if [ "$#" -ne 1 ]
then
echo "Error: No domain name argument provided"
echo "Usage: Provide a domain name as an argument"
exit 1
fi
DOMAIN="server_com"
# Create root CA & Private key
openssl req -x509 -sha256 -days 356 -nodes -newkey rsa:2048 -subj "/CN=$
{DOMAIN}/C=TN/L=Tunisia" -keyout rootCA.key -out rootCA.crt
# Generate Private key
openssl genrsa -out ${DOMAIN}.key 2048
# Create csf conf
cat > csr.conf <<EOF
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[ dn ]
C = TN
ST = Tunis
L = Tunisia
O = IAT
3
OU = Dev
CN = ${DOMAIN}
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = ${DOMAIN}
DNS.2 = www.${DOMAIN}
IP.1 = 127.0.0.1
IP.2 = 127.0.0.1
EOF
# create CSR request using private key
openssl req -new -key ${DOMAIN}.key -out ${DOMAIN}.csr -config csr.conf
# Create a external config file for the certificate
cat > cert.conf <<EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment,
dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = ${DOMAIN}
EOF
# Create SSl with self signed CA
openssl x509 -req -in ${DOMAIN}.csr -CA rootCA.crt -CAkey rootCA.key -

CAcreateserial -out ${DOMAIN}.crt -days 365 -sha256 -extfile cert.conf
2. Set the script executable permission by executing the following command.
- chmod +x ssl.sh
3. Execute the script with the domain name or IP. For example,
- ./ssl.sh server_com
4
The script will create all the certificates and keys. The SSL certificate and private keys get named with
the domain name you pass as the script argument. For example, server_com.key and
server_com.crt.
4. Convert file server_com.crt to server_com.pem
- openssl x509 -in server_com.crt -out server_com.pem
5. Make a copy of server_com.pem and place it in ca-certificates.
- sudo cp « path of server_com »/server_com.pem /usr/local/share/ca-certificates
6. Update ca-certificates
- sudo update-ca-certificates
Install openssl library

- sudo apt-get install libssl-dev
Include openssl library, keys and certifications to the code using

Eclipse.
1. Include ssl and crypto libraries to the code
5
2. Add key and certificate paths to broker code and modify the port.
3. Add ca certificate path to client code and change the server address as the same in broker
code.
In this exemple, ca.pem represents server_com.pem file in ca-certificates.
6
Testing the MQTT secure connection between MQTT Publisher and a
broker over TLS.
MQTT Publisher
Mqtt publisher will publish a topic « hello » containing a message « Mqtt Publisher publishing: Hello
secure C++ world ! »
Server
Wireshark visualization
7
8

MQTT Secure Connection Over TLS

Uploaded by

Copyright:

Available Formats

MQTT Secure Connection Over TLS

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

MQTT Secure Connection Over TLS

Uploaded by

Copyright:

Available Formats

MQTT secure connection over TLS

MQTT: Message Queuing Telemetry Transport Protocol

Types of MQTT messages

MQTT Stack with security layer

To assure a secure communication we need to create differents types of keys

Shell Script To Create Self-Signed Certificate

1. Save the following shell script as ssl.sh

# Create SSl with self signed CA

openssl x509 -req -in ${DOMAIN}.csr -CA rootCA.crt -CAkey rootCA.key -

2. Set the script executable permission by executing the following command.

4. Convert file server_com.crt to server_com.pem

- openssl x509 -in server_com.crt -out server_com.pem

5. Make a copy of server_com.pem and place it in ca-certificates.

- sudo cp « path of server_com »/server_com.pem /usr/local/share/ca-certificates

Install openssl library

Include openssl library, keys and certifications to the code using

1. Include ssl and crypto libraries to the code

In this exemple, ca.pem represents server_com.pem file in ca-certificates.

You might also like