Feedback

Exercise 2 – Adding TLS to the MQTT connection

Now we want to encrypt the MQTT connection that we set up in the previous exercise by implementing TLS. We will also cover how to verify the broker’s authenticity.

Recall from lesson 3 that TLS can provide :

Confidentiality (communication cannot be read by third parties)
Integrity (communication cannot be altered by third parties)
Authenticity (verifies the identity of the client and server).

You can read more about how TLS provides authentication, confidentiality, and integrity here.

In this exercise, we will learn how to encrypt communication between the device (MQTT client) and the MQTT broker. Then we will get the root certificate of the MQTT broker and flash it to the device, so it can use it to verify the broker’s authenticity. We will also show how to encrypt the communication between the MQTT broker and the other MQTT client (running on your PC).

The MQTT helper library uses the TLS credentials subsystem of the Zephyr socket API to provision the credentials on the device at run-time. So we simply have to enable and configure this feature and store the server certificate from the MQTT broker somewhere in the application directory so the MQTT helper library can find it.

Note

If ultra-low power and data cost are a high priority in your design, please be aware that TLS slightly increases the overhead of the data sent over the air which impacts power consumption and data costs.

Exercise Steps

1. In the GitHub repository for this course, go to the base code for this exercise, found in l4/l4_e2.

2. Enable TLS support in the MQTT library.

2.1 Enable TLS for the MQTT library by enabling CONFIG_MQTT_LIB_TLS in prj.conf.

CONFIG_MQTT_LIB_TLS=y

Copy

CONFIG_MQTT_LIB_TLS=y

Kconfig

This will automatically change the broker port CONFIG_MQTT_HELPER_PORT that the MQTT helper library uses to 8883, which is the standard TLS port for MQTT.

2.2 Enable TLS-related Kconfigs.

CONFIG_MBEDTLS=y
CONFIG_TLS_CREDENTIALS=y

Copy

CONFIG_MBEDTLS=y
CONFIG_TLS_CREDENTIALS=y

Kconfig

CONFIG_MBEDTLS: Enables the mbedTLS library.
CONFIG_TLS_CREDENTIALS: Enables the TLS credentials subsystem of the socket API, which we will use to store the credentials on the device.

2.3 Configure the security tag for the certificate.

Configure the security tag for the certificate by adding the following line

CONFIG_MQTT_HELPER_SEC_TAG=24

Copy

CONFIG_MQTT_HELPER_SEC_TAG=24

Kconfig

CONFIG_MQTT_HELPER_SEC_TAG: Security tag where the TLS credentials are stored on the device

2.4 Enable the modem key management library in order to store the server certificate in the modem and use it for verification.

CONFIG_MODEM_KEY_MGMT=y

Copy

CONFIG_MODEM_KEY_MGMT=y

Kconfig

2.5 In main.c, include the header file for the modem key management library.

#include <modem/modem_key_mgmt.h>

Copy

#include <modem/modem_key_mgmt.h>

4. Obtain the certificate from the MQTT broker.

4.1 Using a browser, visit the MQTT broker main page, in this case: https://mqtt.nordicsemi.academy/ and download the mqtt.nordicsemi.academy.chain file in PEM format.

Store the certificate in the directory l4_e2/credentials with the name ca-cert.pem.

Important

Make sure to change the name to ca-cert.pem.

5. Generate an include file from the certificate and include it in the application.

5.1 Generate an include file from the certificate.

We want to generate include files of the certificate and store them in the build output. Create the directory

In CMakeLists.txt, add the following lines

set(gen_dir ${CMAKE_CURRENT_BINARY_DIR}/certs)
zephyr_include_directories(${gen_dir})
generate_inc_file_for_target(app credentials/ca-cert.pem ${gen_dir}/ca-cert.pem)

Copy

set(gen_dir ${CMAKE_CURRENT_BINARY_DIR}/certs)
zephyr_include_directories(${gen_dir})
generate_inc_file_for_target(app credentials/ca-cert.pem ${gen_dir}/ca-cert.pem)

CMake

This creates the certs directory, which you can find after building the application in l4_e2/build/l4_e2/certs.

The next line includes this directory in the application, and the last line generates the include file for the application using the source file we downloaded in the previous step, and places it in l4_e2/build/l4_e2/certs with the name ca-cert.pem.

5.2 Include the certificate in the application.

Include the certificate in the application by adding the following line to main.c

static const unsigned char ca_certificate[] = {
#include "ca-cert.pem"
};

Copy

static const unsigned char ca_certificate[] = {
#include "ca-cert.pem"
};

6. Define certificate_provision() to store the certificates in the modem.

In this function, we write the certificate to the modem, using modem_key_mgmt_write(), which has the following signature

sec_tag – The security tag associated with the certificate, in our case CONFIG_MQTT_HELPER_SEC_TAG.
cred_type – The type of credential we are storing in the modem. To authenticate the server, we use MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN, which is the root certificate of the server issues by the Certificate Authorities.
buf – The actual certificate, which we stored in the ca_certificate.
len – Length of the certificate.

It is important not to rewrite the same certificate every time we boot up the application, to avoid wearing out the flash. Therefore, we are checking if a certificate exists, using modem_key_mgmt_exists(), and if so, checking if it is identical to the one we want to write, using modem_key_mgmt_cmp(). If this is the case, we don’t need to write the certificate to the modem.

Add the following lines to the certificate_provision() function to store the certificate in the modem.

int certificate_provision(void)
{
	int err = 0;
	bool exists;

	err = modem_key_mgmt_exists(CONFIG_MQTT_HELPER_SEC_TAG,
				    MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN,
				    &exists);
	if (err) {
		LOG_ERR("Failed to check for certificates err %d\n", err);
		return err;
	}

	if (exists) {
		err = modem_key_mgmt_cmp(CONFIG_MQTT_HELPER_SEC_TAG,
					 MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN,
				   	ca_certificate,
				   	sizeof(ca_certificate) - 1);
		LOG_INF("Comparing credentials: %s", err ? "Mismatch" : "Match");
		if (!err) {
			return 0;
		}
	}

	err = modem_key_mgmt_write(CONFIG_MQTT_HELPER_SEC_TAG,
				   MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN,
				   ca_certificate,
				   sizeof(ca_certificate) - 1);
	if (err) {
		LOG_ERR("Failed to provision CA certificate: %d", err);
		return err;
	}

	return err;
}

Copy

int certificate_provision(void)
{
	int err = 0;
	bool exists;

	err = modem_key_mgmt_exists(CONFIG_MQTT_HELPER_SEC_TAG,
				    MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN,
				    &exists);
	if (err) {
		LOG_ERR("Failed to check for certificates err %d\n", err);
		return err;
	}

	if (exists) {
		err = modem_key_mgmt_cmp(CONFIG_MQTT_HELPER_SEC_TAG,
					 MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN,
				   	ca_certificate,
				   	sizeof(ca_certificate) - 1);
		LOG_INF("Comparing credentials: %s", err ? "Mismatch" : "Match");
		if (!err) {
			return 0;
		}
	}

	err = modem_key_mgmt_write(CONFIG_MQTT_HELPER_SEC_TAG,
				   MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN,
				   ca_certificate,
				   sizeof(ca_certificate) - 1);
	if (err) {
		LOG_ERR("Failed to provision CA certificate: %d", err);
		return err;
	}

	return err;
}

7. Store the certificate in the modem while the modem is in offline mode

To use any cryptographic functions in the modem, the application must provision the security credentials to the modem. To be able to provision credentials, the modem must be in offline mode.

This is why it is important to call certificate_provision() in modem_configure(), right after initializing the nRF Modem library when the modem is still in offline mode.

Add the following code snippet in the main.c file.

	err = certificate_provision();
	if (err) {
		LOG_ERR("Failed to provision certificates");
		return err;
	}

Copy

	err = certificate_provision();
	if (err) {
		LOG_ERR("Failed to provision certificates");
		return err;
	}

8. Build the exercise and flash it on your board.

9. Examine the log output.

On a successful connection to an LTE network and connection to the MQTT broker, you should see an output similar to the one below.

*** Booting nRF Connect SDK *
[00:00:00.294,250] <inf> Lesson4_Exercise2: Initializing modem library
[00:00:00.562,438] <inf> Lesson4_Exercise2: Connecting to LTE network
[00:00:01.589,202] <inf> Lesson4_Exercise2: RRC mode: Connected
[00:00:05.935,485] <inf> Lesson4_Exercise2: Network registration status: Connected - roaming
[00:00:05.935,577] <inf> Lesson4_Exercise2: Connected to LTE network
[00:00:08.415,283] <inf> Lesson4_Exercise2: Connected to MQTT broker
[00:00:08.415,344] <inf> Lesson4_Exercise2: Hostname: mqtt.nordicsemi.academy
[00:00:08.415,374] <inf> Lesson4_Exercise2: Client ID: nrf-355025930008030
[00:00:08.415,374] <inf> Lesson4_Exercise2: Port: 8883
[00:00:08.415,405] <inf> Lesson4_Exercise2: TLS: Yes
[00:00:08.415,435] <inf> Lesson4_Exercise2: Subscribing to devacademy/subscribe/topic
[00:00:08.550,384] <inf> Lesson4_Exercise2: Subscribed to devacademy/subscribe/topic with QoS 0
[00:00:11.370,697] <inf> Lesson4_Exercise2: RRC mode: Idle

Terminal

Testing

We will basically follow the same test procedure we used in Exercise 1, except this time we will have to configure the client to use TLS and configure it to use the server root certificate issued by the certificate authority.

10. In MQTT Explorer, add a new connection and set it up as shown in the illustration below. Note that the port number changed to 8883:

11. Add the server (MQTT broker) root certificate (ca-cert.pem) by clicking on the advanced button.

Click on CERTIFICATES:

Then select SERVER CERTIFICATE (CA) and select the .pem file we downloaded earlier.

12. Add the topic that the nRF91 Series device will publish to.

This was defined in the Kconfig CONFIG_MQTT_SAMPLE_PUB_TOPIC, in our case "devacademy/publish/topic“

After adding the certificate click BACK, so you get to the window like below, and type in the MQTT topic the device will publish to under Topic. Then select ADD.

Click back again, and make sure to save the connection settings by selecting SAVE.

13. Press CONNECT to establish a connection with the MQTT broker.

Then repeat the last two steps of the previous exercise to check that the communcation is working by controlling the LED’s and being noified on button pushes on the device.

The functionality of this exercise is identical to the previous one, except for the fact that communication now is over TLS so it ensures confidentiality, integrity of the data sent over the network, and authentication of the server.

The solution for this exercise can be found in l4/l4_e2_sol.

Nordic Developer Academy Terms of Service

1. Introduction

‍These terms and conditions (“Terms of Use”) apply to the use of the Nordic Developer Academy, provided by Nordic Semiconductor ASA, org. nr. 966 011 726, a public limited liability company registered in Norway (“Nordic Semiconductor”). ‍

Nordic Developer Academy allows the user to take technical courses related to Nordic Semiconductor products, software and services, and obtain a certificate certifying completion of these courses. By completing the registration process for the Nordic Developer Academy, you are agreeing to be bound by these Terms of Use.

These Terms of Use are applicable as long as you have a user account giving you access to Nordic Developer Academy.‍

‍2. Access to and use of Nordic Developer Academy

‍‍Upon acceptance of these Terms of Use you are granted a non-exclusive right of access to, and use of Nordic Developer Academy, as it is provided to you at any time. Nordic Semiconductor provides Nordic Developer Academy to you free of charge, subject to the provisions of these Terms of Use and the Nordic Developer Academy Privacy Policy.

To access select features of Nordic Developer Academy, you need to create a user account. You are solely responsible for the security associated with your user account, including always keeping your login details safe.

You will able to receive an electronic certificate from Nordic Developer Academy upon completion of courses. By issuing you such a certificate, Nordic Semiconductor certifies that you have completed the applicable course, but does not provide any further warrants or endorsements for any particular skills or professional qualifications.

Nordic Semiconductor will continuously develop Nordic Developer Academy with new features and functionality, but reserves the right to remove or alter any existing functions without notice.

‍3. Acceptable use

You undertake that you will use Nordic Developer Academy in accordance with applicable law and regulations, and in accordance with these Terms of Use.‍ You must not modify, adapt, or hack Nordic Developer Academy or modify another website so as to falsely imply that it is associated with Nordic Developer Academy, Nordic Semiconductor, or any other Nordic Semiconductor product, software or service.

You agree not to reproduce, duplicate, copy, sell, resell or in any other way exploit any portion of Nordic Developer Academy, use of Nordic Developer Academy, or access to Nordic Developer Academy without the express written permission by Nordic Semiconductor. You must not upload, post, host, or transmit unsolicited email, SMS, or \”spam\” messages.

You are responsible for ensuring that the information you post and the content you share does not;

contain false, misleading or otherwise erroneous information
infringe someone else’s copyrights or other intellectual property rights
contain sensitive personal data or
contain information that might be received as offensive or insulting.
Such information may be removed without prior notice.

‍Nordic Semiconductor reserves the right to at any time determine whether a use of Nordic Developer Academy is in violation of its requirements for acceptable use.

Violation of the at any time applicable requirements for acceptable use may result in termination of your account. We will take reasonable steps to notify you and state the reason for termination in such cases.

‍4. Routines for planned maintenance

‍Certain types of maintenance may imply a stop or reduction in availability of Nordic Developer Academy. Nordic Semiconductor does not warrant any level of service availability but will provide its best effort to limit the impact of any planned maintenance on the availability of Nordic Developer Academy.

5. Intellectual property rights

‍Nordic Semiconductor retains all rights to all elements of Nordic Developer Academy. This includes, but is not limited to, the concept, design, trademarks, know-how, trade secrets, copyrights and all other intellectual property rights.

Nordic Semiconductor receives all rights to all content uploaded or created in Nordic Developer Academy. You do not receive any license or usage rights to Nordic Developer Academy beyond what is explicitly stated in this Agreement.

‍6. Liability and damages

‍Nothing within these Terms of Use is intended to limit your statutory data privacy rights as a data subject, as described in the Nordic Developer Academy Privacy Policy. ‍You acknowledge that errors might occur from time to time and waive any right to claim for compensation as a result of errors in Nordic Developer Academy. When an error occurs, you shall notify Nordic Semiconductor of the error and provide a description of the error situation.

You agree to indemnify Nordic Semiconductor for any loss, including indirect loss, arising out of or in connection with your use of Nordic Developer Academy or violations of these Terms of Use. ‍Nordic Semiconductor shall not be held liable for, and does not warrant that (i) Nordic Developer Academy will meet your specific requirements, (ii) Nordic Developer Academy will be uninterrupted, timely, secure, or error-free, (iii) the results that may be obtained from the use of Nordic Developer Academy will be accurate or reliable, (iv) the quality of any products, services, information, or other material purchased or obtained by you through Nordic Developer Academy will meet your expectations, or that (v) any errors in Nordic Developer Academy will be corrected.

You accept that this is a service provided to you without any payment and hence you accept that Nordic Semiconductor will not be held responsible, or liable, for any breaches of these Terms of Use or any loss connected to your use of Nordic Developer Academy. Unless otherwise follows from mandatory law, Nordic Semiconductor will not accept any such responsibility or liability.

‍7. Change of terms

‍Nordic Semiconductor may update and change the Terms of Use from time to time. Nordic Semiconductor will seek to notify you about significant changes before such changes come into force and give you a possibility to evaluate the effects of proposed changes. Continued use of Nordic Developer Academy after any such changes shall constitute your acceptance of such changes. You can review the current version of the Terms of Use at any time at https://academy.nordicsemi.com/terms-of-service/

‍8. Transfer of rights

‍Nordic Semiconductor is entitled to transfer its rights and obligation pursuant to these Terms of Use to a third party as part of a merger or acquisition process, or as a result of other organizational changes.

‍9. Third Party Services

‍‍To the extent Nordic Developer Academy facilitates access to services provided by a third party, you agree to comply with the terms governing such third party services. Nordic Semiconductor shall not be held liable for any errors, omissions, inaccuracies, etc. related to such third party services.

‍10. Dispute resolution

‍‍The Terms of Use and any other legally binding agreement between yourself and Nordic Semiconductor shall be subject to Norwegian law and Norwegian courts’ exclusive jurisdiction.

Cellular IoT Fundamentals

Exercise 2 – Adding TLS to the MQTT connection

Note

Exercise Steps

Important

Switch language?

Change summary

What's new in the latest version

MCUboot & Partition Manager