ESP32 Forum

Posted: **Thu Jun 02, 2022 9:57 pm**

Description

We are trying to setup ESP IDF to connect with the build in MQTT server of thingsboard. We have setup the certificates as suggested in the tutorial by thingsboard with self signed certicates https://thingsboard.io/docs/user-guide/ ... generation. We can connect using MQTT explorer on a windows machine. I expect we need to do a mutual on the ESP side but whatever we have tried so far we can't connect.

Code: [Select all] [Expand/Collapse]

esp_mqtt_client_config_t clientConfig = {
    .host = MQTT_HOST,
    .port = 8883,
    .client_id = NULL,
    .username = username,
    .disable_auto_reconnect = true,
    .user_context = context,
    .cert_pem = "-----BEGIN CERTIFICATE-----\n" // openssl command as suggested on ESP IDF
               "..."
               "-----END CERTIFICATE-----\0",
    .transport = MQTT_TRANSPORT_OVER_SSL,
    .skip_cert_common_name_check = true,
};

GeSHi © Codebox Plus Extension

As mentioned above the ESP IDF suggests https://docs.espressif.com/projects/esp ... t.html#ssl getting the cert_pem option by getting this using the following command

Code: [Select all] [Expand/Collapse]

openssl s_client -showcerts -connect mqtt.eclipseprojects.io:8883 </dev/null 2>/dev/null|openssl x509 -outform PEM >mqtt_eclipse_org.pem

GeSHi © Codebox Plus Extension

Of course the url here is replaced with our own. This certificate is then used as .cert_pem.

The error we are currently getting from ESP-MQTT is 0x8008 https://docs.espressif.com/projects/esp ... codes.html.

Environment

OS: Ubuntu + Docker
ThingsBoard: Latest (v3.3.4.1)
ESP-IDF: Stable (4.4.1)

Dockerfile (using a proxy for http(s)):

Code: [Select all] [Expand/Collapse]

version: '3'
 
services:
  thingsboard:
    restart: unless-stopped
    image: thingsboard/tb-postgres
    environment:
      - TB_QUEUE_TYPE=in-memory
      - TZ=Europe/Amsterdam
      - MQTT_SSL_ENABLED=true
      - MQTT_SSL_CREDENTIALS_TYPE=PEM
      - MQTT_SSL_PEM_CERT=/certs/server.pem
      - MQTT_SSL_PEM_KEY=/certs/server_key.pem
      - MQTT_SSL_SKIP_VALIDITY_CHECK_FOR_CLIENT_CERT=true
    volumes:
      - type: bind
        source: ./thingsboard/data
        target: /data
      - type: bind
        source: ./thingsboard/logs
        target: /var/log/thingsboard
      - type: bind
        source: ./thingsboard/certs
        target: /certs
    ports:
      - 1883:1883
      - 8883:8883
      - 7070:7070
      - 5683-5688:5683-5688/udp

GeSHi © Codebox Plus Extension

Posted: **Fri Jun 03, 2022 4:43 am**

There is one value wrong in mqtt config, but i am not 100% sure its the case. client_id cant be NULL.

Posted: **Sat Jun 04, 2022 9:52 am**

Unfortunately this was not a solution to our problem. Still receiving the same error.

In menuconfig we have CONFIG_MQTT_PROTOCOL_311 enabled. And we also enabled CONFIG_ESP_TLS_INSECURE and CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY.

Posted: **Mon Jun 06, 2022 11:32 am**

The error 0x8008 is ESP_ERR_ESP_TLS_TCP_CLOSED_FIN. It seems the peer send FIN to close the connection. I have no idea why the server send FIN. You can use MQTT client tool to connect your server and compare with it.

Posted: **Fri Jun 10, 2022 8:27 am**

ESP_YJM wrote: ↑
Mon Jun 06, 2022 11:32 am
The error 0x8008 is ESP_ERR_ESP_TLS_TCP_CLOSED_FIN. It seems the peer send FIN to close the connection. I have no idea why the server send FIN. You can use MQTT client tool to connect your server and compare with it.

This is true! Unfortunately this was not documented on the error code page.

I had not noticed the mqtt-explorer client on our desktop also disconnected after a short amount of time when logged in with the account for provisioning because mqtt-explorer reconnects automatically.

After we had readded the log line that was removed when changing the MQTT_EVENT_DATA handler from the example it became clear that the connection closed a lot later then we received data, and then found out that the provision response was not processed.

Code: Select all

// we used
if (strcmp(topic, "/provision/response")) {}
// but we should have done
if (strcmp(topic, "/provision/response") == 0) {}

A simple C error, but hard to notice without proper debugging

Thanks for your response!

ESP32 Forum

How to setup MQTT over SSL with ESP IDF

How to setup MQTT over SSL with ESP IDF

Re: How to setup MQTT over SSL with ESP IDF

Re: How to setup MQTT over SSL with ESP IDF

Re: How to setup MQTT over SSL with ESP IDF

Re: How to setup MQTT over SSL with ESP IDF