Issues connecting to point perfect mqtt server

[brianmcrae]

Using the information we have in our subscrtion u-center-xxx.json config file, we are trying to make a connection to the point perfect mqtt server (ssl://pp.services.u-blox.com:8883). When we use the key, cert and rootCA data in this file to create files for ssl all we get are ssl errors when we load these files as the CRT and PEM file. No combination seems to work even after we try to make a signed key use openssl with the data. Has anyone used pygpsclient to connect the point perfect server? Is so how is it done and what are we missing?

[semuadmin]

Hi @brianmcrae

Has anyone used pygpsclient to connect the point perfect server? Is so how is it done and what are we missing?

So, yes, many people have used PyGPSClient to connect to a PointPerfect MQTT SPARTN service. The README provides an illustrated example of just such a connection. There are, however, a number of prerequisites (largely dictated by ThingStream rather than PyGPSClient), all clearly articulated in the README.

You mention "SSL errors" - which specific error(s) are you seeing and which platform (operating system version and Python version) are you running on? If you're referring to a SSL: CERTIFICATE_VERIFY_FAILED error, the following may help:

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)

This is because PyGPSClient's underlying MQTT client (pygnssutils.gnssmqttclient) is unable to locate the RootCA certificate for the MQTT Broker. This can normally be resolved as follows:

1. Install the latest version of certifi:

python3 -m pip install --upgrade certifi

2. If using MacOS, run the following command from the terminal (substituting your Python path and version as required):

/Applications/Python\ 3.12/Install\ Certificates.command

See also pygnssutils Troubleshooting and (for example) python-macos-and-certificate-verify-errors.

For further diagnostic information, try running PyGPSClient with maximum verbosity and review the debug output:

pygpsclient --verbosity 3

[brianmcrae]

We get the following error:

Exception in thread Thread-2 (_run):
Traceback (most recent call last):
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.13_3.13.1008.0_x64__qbz5n2kfra8p0\Lib\threading.py", line 1041, in _bootstrap_inner
self.run()
~~~~~~~~^^
File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.13_3.13.1008.0_x64__qbz5n2kfra8p0\Lib\threading.py", line 992, in run
self._target(*self._args, **self._kwargs)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\brian\Documents\pyGPSClient\venv\Lib\site-packages\pygnssutils\gnssmqttclient.py", line 297, in _run
client.tls_set(certfile=settings["tlscrt"], keyfile=settings["tlskey"])
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\brian\Documents\pyGPSClient\venv\Lib\site-packages\paho\mqtt\client.py", line 1285, in tls_set
context.load_cert_chain(certfile, keyfile, keyfile_password)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ssl.SSLError: [SSL] PEM lib (_ssl.c:4107)

Steps to create this error.

1. We open the u-center-xxx-config.json file using the GNSS RECEIVER CONFIGURATION diaglog
2. Make sure the gnss is connected using the L-BAND CORRECTION CONFIGURATION diaglog
3. copy the "cert" in that file into a file and save it as u-center-config.crt with the header of ----BEGIN CERTIFICATE----- and the matching footer.
4. copy the "key" in that file into a file and save it as u-center-key.pem with -----BEGIN ENCRYPTED PRIVATE KEY----- above and matching footer below.
5. We use these files for the CRT and PEM files using the file diaglogs.
6. Get the above error.

We have also tried many different files names in case that we required, including the ones filled in when we load the config json.

Are we supposed to do something with the data in the json config file? Do we need to convert it in some way?

here are the files involved:

device-68168c2c-de75-4d4b-863c-7b2ecd18aab3-ucenter-config.json

ucenter-config-cert.zip

[brianmcrae]

doing the suggested certifi upgrade did not help

[brianmcrae]

Also there is a RootCA in the json config file. Should that be saved somewhere?

[semuadmin]

@brianmcrae

Ok it sounds like your PEM files is corrupted (it doesn't recognise the -----BEGIN ENCRYPTED PRIVATE KEY----- header). I take it you're using Windows, but I'm not entirely clear why you've adopted the procedure you describe to produce these files, or why you reference the L-BAND CORRECTION CONFIGURATION dialog above if you're using an MQTT service - the two are completely different?

Assuming you are indeed using an MQTT service rather than an L-BAND service, and you have an active subscription, the way this is intended to work is quite straightforward:

1. Make a note of your PointPerfect ClientID (aka DeviceID), and pass this to PyGPSClient. You can do this in one of 3 ways:
   a. set the mqttclientid_s parameter in your pygpsclient.json configuration file.
   b. pass it as a keyword argument --mqttclientid.
   c. set an environment variable MQTTCLIENTID.
2. Log into your ThingStream PointPerfect Account.
3. Navigate to the Location Things tab and select your activated MQTT service (e.g. PointPerfect MQTT 100H).

4. Select the Credentials tab and download the Client Key (*.pem) and Client Certificate (*.crt) files provided to your HOME directory (the Root Certificate is not normally required). The default naming convention is:

   • device-abcd1234-ab12-ab12-1234-abcdef123456-pp-cert.crt
   • device-abcd1234-ab12-ab12-1234-abcdef123456-pp-key.pem

   where abcd1234-ab12-ab12-1234-abcdef123456 is your ClientID.

5. NB: You shouldn't need to rename, edit or manipulate these files in any way - simply copy them to your HOME directory and PyGPSClient should pick them up automatically. If you decide to download them to a different folder, simply navigate to this location using PyGPSClient's IP CORRECTION CONFIGURATION (MQTT) dialog.

6. By way of illustration, the files I'm using look like this:

-----BEGIN CERTIFICATE-----
MIIDWTCCAkGgAwIBAgIUC02hLlZ0H8+LOY5jpoTCGYP5oqowDQYJKoZIhvcNAQEL
...
B3ypCUYmigrhErMXMklIIoGr5dGlfXZ0cxgNaaiiHm33PkG84f4Q5t6+lFUb
-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAnUsA/MLrbaExGfklfAMVC42wHMMOe3isbr6KZbRzSFBHeKBv
...
xZvgt+JSUFNTuAoBHbHdWGCPLNqwJgDrVSrjw86CBGK40Bo+Oulm
-----END RSA PRIVATE KEY-----

Have you tried using this procedure exactly as described?

[semuadmin]

By way of confirmation, here's a recent screen shot of PyGPSClient receiving and successfully decrypting SPARTN IP data from a PointPerfect MQTT 100H service:

The current and next SPARTN decryption keys have been automatically extracted from the incoming RXM-SPARTN-KEY message and will be uploaded to the connected GNSS receiver (e.g. ZED-F9P). No other manual intervention is required.

[brianmcrae]

Let's mark this answered. The key I was missing you are correct. My program was reading the json file string and creating the files automatically, but the headers / footers were incorrect. Might want to update the instructions with that small detail, the key needs the type and private key header like your file shows. Sometimes its the simple things. I now have program that creates these correctly and it works. The cert and key files were the issue.

[brianmcrae]

Also it is much easier to just download the keys as you pointed out. The team member who was helping me (he has the subscription) forgot to send the key files over, so I just assumed the keys came from the json file.

[semuadmin]

Also it is much easier to just download the keys as you pointed out. The team member who was helping me (he has the subscription) forgot to send the key files over, so I just assumed the keys came from the json file.

No worries. The recommended procedure is detailed in the README, but who reads this, right? 😏

Might be worth emphasising that the TLS certificate and key only need to be downloaded once - they will not change for the duration of the PointPerfect account. Once installed, PyGPSClient can automatically extract the necessary SPARTN decryption keys from the incoming MQTT data stream (provided you are subscribed to the 'key' topic) and upload these to the receiver (e.g. ZED-F9P). No further manual intervention is required going forward.

If, on the other hand, you choose to import this data from the *ucenter-config.json file, you will need to repeat this process every 4 weeks, as the SPARTN decryption keys are cycled periodically.

So the intention was to make life easier. I have, nonetheless, made a small change to gnssmqttclient to clarify the error message in these circumstances - it will now read Invalid Certificate or Key File [SSL] PEM lib etc..