HARTING MICA: Make a Safe(r) MQTT Container with Certificate and TLS/SSL

RE: HARTING MICA: Make a Safe(r) MQTT Container with Certificate and TLS/SSL

Jan Cumps — Sun, 06 Dec 2020 20:57:17 GMT

The Harting MICA MQTT container version 2.5 allows to set up secure server from its management console.

No need to create your own anymore.

I like it when posts go obsolete because the supplier provides a better way to handle this.

RE: HARTING MICA: Make a Safe(r) MQTT Container with Certificate and TLS/SSL

Jan Cumps — Mon, 10 Jun 2019 20:05:16 GMT

There is an issue with my container. It doesn't restart after reboot and running "service mosquitto start" doesn't work.

Running "service mosquitto status" returns fail.

There's no log in /var/logs, and "dmesg | tail" shows no errors.

Uninstalling and re-installing mosquitto works.

To investigate ...

RE: HARTING MICA: Make a Safe(r) MQTT Container with Certificate and TLS/SSL

Jan Cumps — Sun, 09 Jun 2019 19:23:16 GMT

MQTT + Mica gurus, do you know why my Node Red flow resolves MQTTRoadtest as a valid server name?

I use blok MQTT In

[View:/resized-image/__size/1389x527/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-270d6652-fbe1-4feb-9329-361cc06281da/contentimage_5F00_193176.png:1389:527]

The server name is MQTTRoadtest-mica-grvnb.local. But node-red finds and connects to the mosquitto server running on that machine if I don't type -mica-grvbn.local.

The node Red mosquitto server is running on a host called NodeRed-mica-grvnb.local.

If I ping MQTTRoadtest from the Node Red server's command line, it doesn't resolve.

I tested all combinations, but only MQTTRoadtest and MQTTRoadtest-mica-grvnb.local result in a successful connection.

RE: HARTING MICA: Make a Safe(r) MQTT Container with Certificate and TLS/SSL

Jan Cumps — Sun, 05 May 2019 11:27:58 GMT

A first test with full secure flow from an external source (my laptop) sending data to MQTT server (on the MICA) over TSL,

then Node-red (also running on the MICA) also securely subscribing to that same MQTT,

and reporting received data to a new dashboard tab called RoadTest:

[View:/resized-image/__size/726x238/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-270d6652-fbe1-4feb-9329-361cc06281da/3036.contentimage_5F00_193175.png:726:238]

(edit: not full secure because the standard Node Red container is open. I can get at the editor and the dashboard without any authentication, and can send direct messages too)

RE: HARTING MICA: Make a Safe(r) MQTT Container with Certificate and TLS/SSL

DAB — Mon, 29 Apr 2019 18:46:20 GMT

Good update Jan.

DAB

RE: HARTING MICA: Make a Safe(r) MQTT Container with Certificate and TLS/SSL

Jan Cumps — Mon, 29 Apr 2019 12:48:57 GMT

I tested if I could fool the system, by logging on without TLS, using a different certificate, ...

[embed:dc8ab71f-3b98-42d9-b0f6-e21e02a0f8e2:3ef06e6b-9b7d-4651-b12d-db8be7f5e991:type=text&text=tail+-f+%2Fvar%2Flog%2Fmosquitto%2Fmosquitto.log]

[embed:dc8ab71f-3b98-42d9-b0f6-e21e02a0f8e2:3ef06e6b-9b7d-4651-b12d-db8be7f5e991:type=text&text=1556540325%3A+Client+connection+from+192.168.1.4+failed%3A+error%3A1408F10B%3ASSL+routines%3Assl3_get_record%3Awrong+version+number.%0A....%0A1556540325%3A+New+connection+from+192.168.1.4+on+port+8883.%0A1556540325%3A+OpenSSL+Error%3A+error%3A1408F10B%3ASSL+routines%3Assl3_get_record%3Awrong+version+number%0A1556540325%3A+Socket+error+on+client+%3Cunknown%3E%2C+disconnecting.%0A...%0A1556540354%3A+New+connection+from+192.168.1.4+on+port+8883.%0A1556540354%3A+OpenSSL+Error%3A+error%3A14094416%3ASSL+routines%3Assl3_read_bytes%3Asslv3+alert+certificate+unknown%0A1556540354%3A+Socket+error+on+client+%3Cunknown%3E%2C+disconnecting.]

...

It looks like the security is working.