Skip to content

Commit 97a70a1

Browse files
Tico06Tico06
authored
New TLS implementation (#1520)
* New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * Update MyConfig.h Typo * Update GatewayESP8266SecureMQTTClient.ino Typo * MyGatewayTransportMQTTClient.cpp updated Move tls settings to bool gatewayTransportInit(void) * MySensors code styling applied by GIT * Try to fix Doxygen warnings * Doxygen warnings fixed hopefuly * MY_GATEWAY_ESP8266_SECURE doc added * MY_GATEWAY_ESP8266_SECURE doc completed * Avoid platform cross compiling * Replaced spaces indent by tabs * Multilines comments to /*
1 parent b49817b commit 97a70a1

File tree

6 files changed

+524
-30
lines changed

6 files changed

+524
-30
lines changed

‎.ci/arduino.groovy

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ def buildMySensorsMicro(config, sketches, String key) {
5151
for (sketch = 0; sketch < sketches.size(); sketch++) {
5252
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
5353
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
54+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
5455
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
5556
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
5657
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -87,6 +88,7 @@ def buildMySensorsGw(config, sketches, String key) {
8788
if (sketches[sketch].path != config.library_root+'examples/BatteryPoweredSensor/BatteryPoweredSensor.ino' &&
8889
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
8990
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
91+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
9092
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
9193
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
9294
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -123,6 +125,7 @@ def buildArduinoUno(config, sketches, String key) {
123125
for (sketch = 0; sketch < sketches.size(); sketch++) {
124126
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
125127
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
128+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
126129
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
127130
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
128131
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -157,6 +160,7 @@ def buildArduinoMega(config, sketches, String key) {
157160
for (sketch = 0; sketch < sketches.size(); sketch++) {
158161
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
159162
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
163+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
160164
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
161165
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
162166
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -191,6 +195,7 @@ def buildSTM32F1(config, sketches, String key) {
191195
for (sketch = 0; sketch < sketches.size(); sketch++) {
192196
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
193197
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
198+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
194199
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
195200
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
196201
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -280,6 +285,7 @@ def buildESP32(config, sketches, String key) {
280285
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
281286
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
282287
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
288+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
283289
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
284290
sketches[sketch].path != config.library_root+'examples/SensebenderGatewaySerial/SensebenderGatewaySerial.ino' &&
285291
sketches[sketch].path != config.library_root+'examples/MotionSensorRS485/MotionSensorRS485.ino' &&
@@ -316,6 +322,7 @@ def buildnRF5(config, sketches, String key) {
316322
sketches[sketch].path != config.library_root+'examples/DustSensorDSM/DustSensorDSM.ino' &&
317323
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
318324
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
325+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
319326
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
320327
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
321328
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -396,4 +403,4 @@ def buildnRF51822(config, sketches, String key) {
396403
}
397404
}
398405

399-
return this
406+
return this

‎MyConfig.h

Lines changed: 66 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1426,6 +1426,8 @@
14261426
* @brief Define this for Ethernet GW based on the ENC28J60 module.
14271427
* @def MY_GATEWAY_ESP8266
14281428
* @brief Define this for Ethernet GW based on the ESP8266.
1429+
* @def MY_GATEWAY_ESP8266_SECURE
1430+
* @brief Define this for Ethernet GW based on the ESP8266 with TLS.
14291431
* @def MY_GATEWAY_ESP32
14301432
* @brief Define this for Ethernet GW based on the ESP32.
14311433
* @def MY_GATEWAY_LINUX
@@ -1441,6 +1443,7 @@
14411443
//#define MY_GATEWAY_W5100
14421444
//#define MY_GATEWAY_ENC28J60
14431445
//#define MY_GATEWAY_ESP8266
1446+
//#define MY_GATEWAY_ESP8266_SECURE
14441447
//#define MY_GATEWAY_ESP32
14451448
//#define MY_GATEWAY_LINUX
14461449
//#define MY_GATEWAY_TINYGSM
@@ -1548,29 +1551,79 @@
15481551
//#define MY_MQTT_SUBSCRIBE_TOPIC_PREFIX "mygateway1-in"
15491552

15501553
/**
1551-
* @def MY_MQTT_CA_CERT
1552-
* @brief Set a specific CA certificate needed to validate MQTT server against. Use the certificate as a trust anchor, accepting remote certificates signed by it.
1554+
* @def MY_MQTT_CA_CERT1
1555+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt server' certificate. The most secure.
1556+
*
1557+
* This define is mandatory when you need connect MQTT over SSL/TLS. Certificate Authorities.
1558+
* The best method to validate server certificates.
1559+
* Advised to retrieve root Certificate Authorities as they expire less often than server certificates.
1560+
* With let's encrypt you may need up to three Certificate Authorities
15531561
*
1554-
* This define is mandatory when you need connect MQTT over SSL/TLS.
15551562
* Example: @code
15561563
*
1557-
* const char mqtt_ca_cert[] PROGMEM = R"EOF(
1564+
* const char cert_isrgrootx1_Authority[] PROGMEM = R"EOF(
15581565
* ----- BEGIN THE CERTIFICATE -----
15591566
* XXX ... XXX
15601567
* ----- FINISH CERTIFICATE -----
15611568
* )EOF";
15621569
*
1563-
* #define MY_MQTT_CA_CERT mqtt_ca_cert
1570+
* const char cert_isrgrootx2_Authority[] PROGMEM = R"EOF(
1571+
* ----- BEGIN THE CERTIFICATE -----
1572+
* XXX ... XXX
1573+
* ----- FINISH CERTIFICATE -----
1574+
* )EOF";
1575+
*
1576+
* const char cert_letsEncryptR3_Authority[] PROGMEM = R"EOF(
1577+
* ----- BEGIN THE CERTIFICATE -----
1578+
* XXX ... XXX
1579+
* ----- FINISH CERTIFICATE -----
1580+
* )EOF";
1581+
*
1582+
* #define MY_MQTT_CA_CERT1 cert_isrgrootx1_Authority
1583+
* #define MY_MQTT_CA_CERT2 cert_isrgrootx2_Authority
1584+
* #define MY_MQTT_CA_CERT3 cert_letsEncryptR3_Authority
1585+
*
1586+
* @endcode
1587+
*/
1588+
//#define MY_MQTT_CA_CERT1
1589+
1590+
/**
1591+
* @def MY_MQTT_CA_CERT2
1592+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt serv.
1593+
*/
1594+
//#define MY_MQTT_CA_CERT2
1595+
1596+
/**
1597+
* @def MY_MQTT_CA_CERT3
1598+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt serv.
1599+
*/
1600+
//#define MY_MQTT_CA_CERT3
1601+
1602+
1603+
/**
1604+
* @def MY_MQTT_FINGERPRINT
1605+
* @brief Server certificate validation with its fingerprint
1606+
*
1607+
* The finger print to validate the mqtt server certificate. This is less secure and less convenient
1608+
* than using certificate authorities.
1609+
* Command (3 lines...) to obtain the certificate finger print:
1610+
* @code
1611+
* $>openssl s_client -connect <hostname>:<host port> < /dev/null 2>/dev/null | \
1612+
* openssl x509 -fingerprint -noout -in /dev/stdin \
1613+
* awk -F= '{print $2}'
1614+
* @endcode
15641615
*
1616+
* Example: @code
1617+
* const char mqtt_fingerprint [] PROGMEM = "CA:CE:2B:MD:D3:32:A3:F1:8C:73:9E:1B:B7:D5:75:4A:10:61:E4:05";
15651618
* @endcode
15661619
*/
1567-
//#define MY_MQTT_CA_CERT
1620+
//#define MY_MQTT_FINGERPRINT
15681621

15691622
/**
15701623
* @def MY_MQTT_CLIENT_CERT
15711624
* @brief Set a client certificate to send to a MQTT server that requests one over TLS connection.
15721625
*
1573-
* This define is mandatory when you need connect MQTT over SSL/TLS.
1626+
* This define is mandatory when you need connect MQTT over SSL/TLS and client certificate is requested.
15741627
* Example: @code
15751628
*
15761629
* const char mqtt_client_cert[] PROGMEM = R"EOF(
@@ -1587,9 +1640,9 @@
15871640

15881641
/**
15891642
* @def MY_MQTT_CLIENT_KEY
1590-
* @brief Set a client private key to send to a MQTT server that requests one over TLS connection.
1643+
* @brief Set the client private key generated with the MY_MQTT_CLIENT_CERT.
15911644
*
1592-
* This define is mandatory when you need connect MQTT over SSL/TLS.
1645+
* This define is mandatory when you need connect MQTT over SSL/TLS and client certificate is requested.
15931646
* Example: @code
15941647
*
15951648
* const char mqtt_client_key[] PROGMEM = R"EOF(
@@ -2373,7 +2426,10 @@
23732426
#define MY_MQTT_CLIENT_ID
23742427
#define MY_MQTT_PUBLISH_TOPIC_PREFIX
23752428
#define MY_MQTT_SUBSCRIBE_TOPIC_PREFIX
2376-
#define MY_MQTT_CA_CERT
2429+
#define MY_MQTT_CA_CERT1
2430+
#define MY_MQTT_CA_CERT2
2431+
#define MY_MQTT_CA_CERT3
2432+
#define MY_MQTT_FINGERPRINT
23772433
#define MY_MQTT_CLIENT_CERT
23782434
#define MY_MQTT_CLIENT_KEY
23792435
#define MY_SIGNAL_REPORT_ENABLED

0 commit comments

Comments
 (0)