Add documentation for WiFiClientSecure (including usage of client side certificates)

[HW-Siew]

Hi,

I am using Mqtt with esp8266. I am wondering does esp8266 support clients certificate for authentication?

Thanks for the advice.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[Links2004]

yes there are functions for it:
https://github.com/esp8266/Arduino/blob/master/libraries/ESP8266WiFi/src/WiFiClientSecure.h#L52-L66

[HW-Siew]

Hi @Links2004, Thank you so much for the information. Any documentation or guide on how the certificate can be uploaded to the wifi module and so?

[igrr]

@HW-Siew we don't have documentation for this. You can upload files to the ESP8266 filesystem (we have a plugin which simplifies this task), and then you can pass these files to WiFiClientSecure.

[noelgeorgi]

I could use esptool.py to upload the crt file, but how to use it in the function
*void setCertificate(const uint8_t cert_data, size_t size);
void setPrivateKey(const uint8_t* pk, size_t size);

bool loadCertificate(Stream& stream, size_t size);
bool loadPrivateKey(Stream& stream, size_t size);

template
bool loadCertificate(TFile& file) {
return loadCertificate(file, file.size());
}

template
bool loadPrivateKey(TFile& file) {
return loadPrivateKey(file, file.size());
}
An**y help regarding this post will be greatly appreciated by me and the MySensors community, enabling us to have secure MQTT communication for brokers running in the cloud

[noelgeorgi]

@HW-Siew @igrr solved the issue. I am using pubsubclient mqtt library for arduino. First install https://github.com/esp8266/arduino-esp8266fs-plugin and upload the crt file to the filesystem.

this is my pubsubclient code:

#include "FS.h"
#include <ESP8266WiFi.h>
#include <PubSubClient.h>

// Update these with values suitable for your network.

const char* ssid = "yourssid";
const char* password = "yourpassword";
const char* mqtt_server = "172.16.0.95"; //MQTT broker ip 
//IPAddress server(172, 16, 0, 95);
void callback(char* topic, byte* payload, unsigned int length) {
  Serial.print("Message arrived [");
  Serial.print(topic);
  Serial.print("] ");
  for (int i = 0; i < length; i++) {
    Serial.print((char)payload[i]);
  }
  Serial.println();

}
WiFiClientSecure espClient;
PubSubClient client(mqtt_server,8883,callback,espClient); //set  MQTT port number to 8883 as per //standard
long lastMsg = 0;
char msg[50];
int value = 0;

void setup_wifi() {

  delay(10);
  // We start by connecting to a WiFi network
  Serial.println();
  Serial.print("Connecting to ");
  Serial.println(ssid);

  WiFi.begin(ssid, password);

  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    Serial.print(".");
  }

  Serial.println("");
  Serial.println("WiFi connected");
  Serial.println("IP address: ");
  Serial.println(WiFi.localIP());
}


void reconnect() {
  // Loop until we're reconnected
  while (!client.connected()) {
    Serial.print("Attempting MQTT connection...");
    // Attempt to connect
    if (client.connect("ESP8266Client","mqttusername","mqttpass")) {
      Serial.println("connected");
      // Once connected, publish an announcement...
      client.publish("outTopic", "hello world");
      // ... and resubscribe
      client.subscribe("inTopic");
    } else {
      Serial.print("failed, rc=");
      Serial.print(client.state());
      Serial.println(" try again in 5 seconds");
      // Wait 5 seconds before retrying
      delay(5000);
    }
  }
}

void setup() {
  Serial.begin(115200);
  setup_wifi();
  delay(1000);
  if (!SPIFFS.begin()) {
    Serial.println("Failed to mount file system");
    return;
  }

File ca = SPIFFS.open("/ca.crt", "r"); //replace ca.crt eith your uploaded file name
  if (!ca) {
    Serial.println("Failed to open ca file");
  }
  else
  Serial.println("Success to open ca file");

if(espClient.loadCertificate(ca))
  Serial.println("loaded");
  else
  Serial.println("not loaded");


  //client.setServer(mqtt_server, 8883);
  //client.setCallback(callback);
}



void loop() {

  if (!client.connected()) {
    reconnect();
  }
  client.loop();

  long now = millis();
  if (now - lastMsg > 2000) {
    lastMsg = now;
    ++value;
    snprintf (msg, 75, "hello world #%ld", value);
    Serial.print("Publish message: ");
    Serial.println(msg);
    client.publish("outTopic", msg);
  }
}

[noelgeorgi]

errors popped up are:
Error: Invalid X509 ASN.1 file (X509 not ok)
please start sntp first !

even though there are some errors MQTT data gets published, but frequent MQTT disconnects, help please??

[Potato-Matic]

In the meantime, if someone has gotten something working for their project with either the wifi client or wifit client secure, it's probably worth posting the code as an example, especially for the latter.