In the previous exercise, we created an MQTT connection over an encrypted TLS link. However, this was not a mutually authenticated connection. The aim of this exercise is to create a fully secure MQTT connection using mTLS.
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network, such as the Internet. The TLS protocol aims primarily to provide security, including privacy (confidentiality), integrity, and authenticity through the use of cryptography, such as the use of certificates, between two or more communicating entities.
The protocol defines the exchange of a sequence of messages over an existing TCP connection resulting in a authenticated and encrypted connection that ensures data integrity.
In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the validity of a public key. The certificate includes the public key and information about it, information about the identity of its owner (called the subject), and the digital signature of an entity that has verified the certificate's contents (called the issuer).
In a typical public-key infrastructure (PKI) scheme, the certificate issuer is a certificate authority (CA), usually a company that charges customers a fee to issue certificates for them.
In order to create TLS connection the client and the server require a set of cryptographic assets. These assets are used during the handshake process to establish a secure connection.
Server certificate : This is a digital certificate that proves the identity of the server and is usually issued by a certificate authority (CA).
Client key : This is a private key that uniquely identifies the client.
Client certificate : This is a digital certificate that proves the identity of the client that contains the public key corresponding to the client key.
Root CA certificate : This is the top most certificate in the server certificate chain used to verify the server. Typically, clients have a catalog of trusted root CA that enable server verification.
For this hands-on exercise, we will use the AWS IoT Core service. The AWS IoT core service offers a fully managed MQTT message broker in addition to other device management services. This service acts as the first point of contact for data originating from a device and provides interfaces to other data storage, analysis and presentation services.
Please make sure to follow the instructions in the AWS documentation.
-
Create an AWS account using the instructions here.
-
Create an AWS IoT policy using the instructions here.
-
Create an AWS IoT thing and get AWS IoT Core credentials. Follow the steps mention here.
At this stage, you should have the following assets from AWS IoT core,
- Data end point address.
- Thing name that will be the client ID.
- Device private key.
- Device certificate.
- Root CA of the AWS server.
In this example, we will use the Cordelia-I EV board as the MQTT client.
The AWS MQTT broker offers a fully secure connection on the port 8883. In this exercise, we will use TLS with mutual authentication. This means that the Cordelia-I client will authenticate the server and the server will perform client verification. A session key is exchanged and the data connection will be encrypted.
You will need the following assets to create this connection.
- Device private key
- Device certificate
- RootCA certificate for AWS
Important
Perform a "Factory Reset". Please note that the reset will typically take 60 seconds. Please wait for at least this time. The PC tool will not show any reaction during that duration, please be patient. Do not power-off or hard reset the EV-board during this time.
In this step, we will upload the device certificate and keys (download from AWS IoT core) to the Cordelia-I's file system. These files will be used by the on-board MQTT client during the connection set up.
In order to upload the file, in the "File operations" tab on the WE UART terminal,
- Type in correct filename in the "FileName" text box.
- Click on "Upload File" button. This will open the file explorer. Navigate to the location where you stored the certificate. Select the file and click on "OK".
-> AT+FileOpen=<filename>,WRITE|CREATE,4096
<- +fileopen:363990529,0
<- OK
-> AT+FileWrite=363990529,0,0,1452, <Content to write>
<-+filewrite:1452
<-OK
<-AT+FileClose=363990529,,
<-OK
Use this process to write the following files,
- Device private key with file name "privatekey.pem"
- Device certificate with file name "cert.pem"
- RootCA certificate downloaded form here with file name "rootca.pem"
Open the WLAN settings tab in the WE UART terminal. In order to connect the Cordelia-I module to your WiFi network,
- Type in the SSID of your WiFi network.
- Choose the correct security type.
- Type in your password.
- Finally click on "Connect".
On successful connection, you will receive a "connect" event as well as an "ipv4_acquired" event.
-> AT+wlanconnect=your_ssid,,WPA_WPA2,your_password,,,
<- OK
<- +eventwlan:connect,your_ssid,0x34:0x31:0xc4:0x4a:0xeb:0x5f
<- +eventnetapp:ipv4_acquired,192.168.178.100,192.168.178.1,192.168.178.1
Congratulations! Your module is now connected to the internet via your WiFi network. You can confirm this by checking the fact that the "mode" and "status" LEDs are now switched on.
In this step, we configure the Cordelia-I module to connect to the public AWS IoT Core broker and send/receive data. The on-board MQTT client on the Cordelia-I module needs to be configured. These parameters are stored in the "user settings" of the module. In the WE UART terminal, use the "Custom command/input" section in the "General" tab to configure the user settings.
The following parameters necessary for this connection:
- MQTT Broker address.
- MQTT port.
- Flags to indicate the type of server used for this connection.
- Set the client ID (Replace "your_client_id" with a meaningful name).
- Full path to the root CA certificate stored on the file system of the Cordelia-I module.
- Full path to the device certificate stored on the file system of the Cordelia-I module.
- Full path to the device private key stored on the file system of the Cordelia-I module.
- Set topic strings to subscribe and publish.
-> AT+set=MQTT,iotHubEndpoint,"a2m4kdan3jizyu-ats.iot.eu-central-1.amazonaws.com"
<- OK
-> AT+set=MQTT,iotHubPort,8883
<- OK
-> AT+set=MQTT,flags,"url|sec"
<- OK
-> AT+set=MQTT,clientId,"AWS_thing_name"
<- OK
-> AT+set=MQTT,rootCAPath,"rootca.pem"
<- OK
-> AT+set=MQTT,clientPrivateKey,"privatekey.pem"
<- OK
-> AT+set=MQTT,clientCertPath,"cert.pem"
<- OK
-> AT+set=SUBTOPIC0,name,"cordelia/+"
<- OK
-> AT+set=PUBTOPIC0,name,"cordelia/apple"
<- OK
[Optional]You could configure additional topics to publish,
-> AT+set=PUBTOPIC1,name,"cordelia/banana"
<- OK
-> AT+set=PUBTOPIC2,name,"cordelia/orange"
<- OK
-> AT+set=PUBTOPIC3,name,"cordelia/kiwi"
<- OK
At this stage make sure that you are connected to the WiFi. If not connected, follow the steps here.
Now that the module is configured, Go to the "IoT Operations" tab and click on "Connect" button. On successful connection, you will the module will generate a "CONNACK" event.
-> AT+iotconnect
<- OK
<- +eventmqtt:info,"CONNACK",0
To exchange data, use the "Publish data" section in the "IoT Operations" tab. Here type in the payload in the text box and click on "Publish custom payload" button to send the data. Alternatively, use the "Generate and publish random payload" button to send random data. We are publishing data to the topics that we have subscribed to. Hence, we receive an echo of the sent message.
-> AT+iotpublish=0,"{"RandomString":"oUykIeOvzm","Number1":104,"Number2":575}"
<- OK
<- +eventmqtt:recv,cordelia/apple,qos0,"{"RandomString":"oUykIeOvzm","Number1":104,"Number2":575}"
Congratulations! Now you have sent data over a fully secure MQTT connection.