Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unable to Connect #1

Open
anwarbashir opened this issue Jan 25, 2018 · 39 comments
Open

Unable to Connect #1

anwarbashir opened this issue Jan 25, 2018 · 39 comments

Comments

@anwarbashir
Copy link

Hi, I have followed the instructions and entered the certificate.pem and private.pem and I have formatted as instructed. I am unable to connect. Just wondering do I need to enter the rootCert anywhere or should I be able to connect without it?
@torntrousers
Copy link
Contributor

torntrousers commented Jan 25, 2018 •
edited
Loading

Which version of the esp8266/arduino code are you using? When I was testing this it was prior to the 2.4.0 release, I did notice once that with the 2.4.0 code I needed a delay after the pubSubClient.connect, otherwise it failed, but I've not had time to debug what was going on. Try adding delay(1000) after that line?

@anwarbashir
Copy link
Author

Hi Anthony, I am using Arduino 1.8.3 and this esp8266 core https://github.com/esp8266/Arduino. There is no pubSubClient.connect, but there is a pubSubCheckConnect() so I added the delay(1000) on line 108 after this call, but it still does not connect. Below is the code that I am using...

I think that your code offers a great way to enable AWS MQTT access, it would be great if I could get it to work for me. I have also provided the errors on the console.

BTW I will also be testing on ESP32. This will use WiFi.h as it does not support ESP8266WiFi.h.

/* ESP8266 AWS IoT
*

  • Simplest possible example (that I could come up with) of using an ESP8266 with AWS IoT.
  • No messing with openssl or spiffs just regular pubsub and certificates in string constants
  • Note: For this to work you do need to do this:
  •   https://github.com/esp8266/Arduino/issues/3944
  • Author: Anthony Elder
  • License: Apache License v2
    */
    #include <ESP8266WiFi.h>
    #include <PubSubClient.h>
    extern "C" {
    #include "libb64/cdecode.h"
    }

const char* ssid = "VM575052-2G";
const char* password = "fcbwkwxz";

const char* awsEndpoint = "akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com";

// For the two certificate strings below paste in the text of your AWS
// device certificate and private key, comment out the BEGIN and END
// lines, add a quote character at the start of each line and a quote
// and backslash at the end of each line:

// xxxxxxxxxx-certificate.pem.crt
const String certificatePemCrt =
//-----BEGIN CERTIFICATE-----Anwar's
"MIIDWjCCAkKgAwIBAgIVAN7hovdIBJfBT3rtD2LwXUTaDZ0YMA0GCSqGSIb3DQEB"
etc...
"+8Mpifaz2YlaudI8c5IQhMa+N99nF4FUkBBhTyl3otCfQJddTdufxEJJKcUM9A==";
//-----END CERTIFICATE-----

// xxxxxxxxxx-private.pem.key
const String privatePemKey =
//-----BEGIN RSA PRIVATE KEY-----Anwars
"MIIEpQIBAAKCAQEAoW79xoQM0Dz4KL62Q1iikRm2gHdkgymXTrHswKGsnLCaAJuA"
etc....
MO0otjoe8=";
//-----END RSA PRIVATE KEY-----

WiFiClientSecure wiFiClient;
void msgReceived(char* topic, byte* payload, unsigned int len);
PubSubClient pubSubClient(awsEndpoint, 8883, msgReceived, wiFiClient);

void setup() {
Serial.begin(115200); Serial.println();
Serial.println("ESP8266 AWS IoT Example");

Serial.print("Connecting to "); Serial.print(ssid);
WiFi.begin(ssid, password);
WiFi.waitForConnectResult();
Serial.print(", WiFi connected, IP address: "); Serial.println(WiFi.localIP());

uint8_t binaryCert[certificatePemCrt.length()];
int len = b64decode(certificatePemCrt, binaryCert);
wiFiClient.setCertificate(binaryCert, len);

uint8_t binaryPrivate[privatePemKey.length()];
len = b64decode(privatePemKey, binaryPrivate);
wiFiClient.setPrivateKey(binaryPrivate, len);
}

unsigned long lastPublish;
int msgCount;

void loop() {

pubSubCheckConnect();
delay(1000); //added for testing

if (millis() - lastPublish > 10000) {
String msg = String("Hello from ESP8266: ") + ++msgCount;
pubSubClient.publish("outTopic", msg.c_str());
Serial.print("Published: "); Serial.println(msg);
lastPublish = millis();
}
}

void msgReceived(char* topic, byte* payload, unsigned int length) {
Serial.print("Message received on "); Serial.print(topic); Serial.print(": ");
for (int i = 0; i < length; i++) {
Serial.print((char)payload[i]);
}
Serial.println();
}

void pubSubCheckConnect() {
if ( ! pubSubClient.connected()) {
Serial.print("PubSubClient connecting to: "); Serial.print(awsEndpoint);
while ( ! pubSubClient.connected()) {
Serial.print(".");
pubSubClient.connect("ESPthing");
}
Serial.println(" connected");
pubSubClient.subscribe("inTopic");
}
pubSubClient.loop();
}

int b64decode(String b64Text, uint8_t* output) {
base64_decodestate s;
base64_init_decodestate(&s);
int cnt = base64_decode_block(b64Text.c_str(), b64Text.length(), (char*)output, &s);
return cnt;
}

---------------------errors in console------------------------
ESP8266 AWS IoT Example
Connecting to VM575052-2G, WiFi connected, IP address: 192.168.0.9
PubSubClient connecting to: akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com.......................................................................................................................................................................................................................................................
Exception (29):
epc1=0x4020c12a epc2=0x00000000 epc3=0x00000000 excvaddr=0x00000004 depc=0x00000000

ctx: cont
sp: 3fff17e0 end: 3fff1cf0 offset: 01a0

stack>>>
3fff1980: 00820000 00000082 3fffa48c 402187a2
3fff1990: 3fff0c78 3fff7564 3fffa48c 40218934
3fff19a0: 00000040 00000082 3fffa474 40218bb5
3fff19b0: 00000104 00009378 00000000 00000041
3fff19c0: 00000040 0000003f 402048f8 00000041
3fff19d0: 00800000 00000080 3fffa42c 3fff7a64
3fff19e0: 3fffbaf8 3fff7564 3fff7564 40218934
3fff19f0: 00000040 3fff7564 3fffa474 3fff7564
3fff1a00: 00000040 3fff7564 3fffa474 4021966b
3fff1a10: 3fff7604 0000003f 76cb3209 00000001
3fff1a20: 3fff7564 3fffa45c 3fffa474 00000001
3fff1a30: 00000010 3fff7564 0000000f 402198c0
3fff1a40: 3fffa42c 3fff7844 0000000f 00000001
3fff1a50: 00000001 3fff7a94 3fff7a94 40218804
3fff1a60: 00000100 3fff75d4 3fff7e5f 00000000
3fff1a70: 00000100 3fff75d4 3fff7e5f 4021aa79
3fff1a80: 3fff1ab0 00000000 000000d0 00000030
3fff1a90: fe234901 00000016 dcd1c582 3fff8a2c
3fff1aa0: 00000004 3fff6abc 3fff7e59 40216468
3fff1ab0: 96970303 f48493f2 059645f4 6680f1b5
3fff1ac0: 1557be95 1da1843b a370df96 be64007e
3fff1ad0: d0843119 76ed2e24 bef51369 49011ea5
3fff1ae0: 00000004 00000000 3fff6abc 4021684a
3fff1af0: 4e3ea496 cf162d20 ac5252ac cb953c30
3fff1b00: 4ebf0e6e b7f2fe1e 981f250c 40794981
3fff1b10: 00000026 3fff8a06 00000018 3fff6c4c
3fff1b20: 0000000e 00000ae8 3fff6bac 00000000
3fff1b30: 0000004a 00000000 00000005 3fff8a2c
3fff1b40: 3fff8a2c 00000004 3fff6abc 3fff8a2c
3fff1b50: 00000004 00000004 3fff6abc 40216270
3fff1b60: 0000007b 3fff7e59 3fff6abc 4021664c
3fff1b70: 00000029 3fff7e8c 3fff6abc 401004d8
3fff1b80: 3fff1bd0 0000000e 00000010 00000000
3fff1b90: 00000000 3fff2584 3fff6abc 01000000
3fff1ba0: 3fff1bd0 3fff3a2c 3fff6abc 402163d8
3fff1bb0: 000022b3 3fff3a2c 3fff0a64 3ffe9508
3fff1bc0: 00013cfc 3fff3a2c 3fff0a64 40203741
3fff1bd0: 3fff0a64 00000000 3fff3a74 40202e32
3fff1be0: 3fff3a74 205e443f 00000040 00000000
3fff1bf0: 000022b3 3fff0a64 3ffe9508 00000000
3fff1c00: 000022b3 3fff0a64 3ffe9508 402039d9
3fff1c10: 3ffe9bb0 cef33334 3ffe9bb0 cef33334
3fff1c20: 00000000 3fff09a8 00000000 40203ccd
3fff1c30: 3fff0c98 00000000 3ffe9a68 40204d60
3fff1c40: 00000000 3ffe89b0 00000000 3fff0cc4
3fff1c50: 3fffdad0 3fff0c98 3fff0c98 3fff0cc4
3fff1c60: 3fffdad0 3fff0c98 3fff09a8 40203e20
3fff1c70: 00000000 00000000 3fff09a8 40204428
3fff1c80: 3ffe8514 3fff0c98 3fff09a8 402021dd
3fff1c90: 0900a8c0 00000000 3fff0cbc 40202228
3fff1ca0: 3ffe8514 3fff0a98 3fff0c98 4020237c
3fff1cb0: 00000000 00000000 00000000 feefeffe
3fff1cc0: feefeffe feefeffe feefeffe 3fff0cc4
3fff1cd0: 3fffdad0 00000000 3fff0cbc 40204944
3fff1ce0: feefeffe feefeffe 3fff0cd0 4010070c
<<<stack<<<

ets Jan 8 2013,rst cause:2, boot mode:(3,5)

load 0x4010f000, len 1384, room 16
tail 8
chksum 0x2d
csum 0x2d
vf6d232f1

@torntrousers
Copy link
Contributor

I meant add the delay here: https://github.com/HarringayMakerSpace/awsiot/blob/master/Esp8266AWSIoTExample/Esp8266AWSIoTExample.ino#L131

@anwarbashir
Copy link
Author

Ahh, sorry - I have changed the correct line but still unable to connect. The only difference is that the it juts keeps trying to connect. Is there anything else I can try? Do I need to name ESPthing to the name of my device?

void pubSubCheckConnect() {
if ( ! pubSubClient.connected()) {
Serial.print("PubSubClient connecting to: "); Serial.print(awsEndpoint);
while ( ! pubSubClient.connected()) {
Serial.print(".");
pubSubClient.connect("ESPthing");
delay(1000); //added for testing
}
Serial.println(" connected");
pubSubClient.subscribe("inTopic");
}
pubSubClient.loop();
}

ESP8266 AWS IoT Example
Connecting to VM575052-2G, WiFi connected, IP address: 192.168.0.9
PubSubClient connecting to: akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com.....................................................................................................................................................................rl

@torntrousers
Copy link
Contributor

I will go try it with Arduino 1.8.3 and the latest esp8266/arduino 2.4.0 code...

@torntrousers
Copy link
Contributor

I've tried this again with Arduino 1.8.3 and the latest esp8266/arduino 2.4.0 code, and the only other version related things is the PubSubClient and for that I'm using Nick O'Leary's version 2.6.0. It works for me and connects to AWS and publishes messages. The delay doesn't seem to matter now for me, though it definitely did before, and I put it here:

void pubSubCheckConnect() {
  if ( ! pubSubClient.connected()) {
    Serial.print("PubSubClient connecting to: "); Serial.print(awsEndpoint);
    while ( ! pubSubClient.connected()) {
      Serial.print(".");
      pubSubClient.connect("ESPthing");
    }
    Serial.println(" connected");
    pubSubClient.subscribe("inTopic");
    delay(1000);
  }
  pubSubClient.loop();
}

Have you definitely got the awsEndpoint and the two certificates correct? Send me your sketch if you like and I can try it here - [email protected]

@anwarbashir
Copy link
Author

Hi, I am using Nick O'Leary's PubSubClient, installed via Arduino Board manager. I would be grateful if you could try my sketch and let me know te outcome.
ESP8266_AWS_IoT_Example.zip
I have attached my sketch here. Instead of AWS I am using certificates provided by a site called NodeCM.io, but they are AWS certificates.

@torntrousers
Copy link
Contributor

torntrousers commented Jan 26, 2018 •
edited
Loading

I've tried yours (the only update to the wifi ssid/password) and it seems to work ok for me. Well it connects ok and publishes a message, anyway. It does appear to always disconnect after doing the publish which is a bit strange. Can you look in your AWS IoT console and see if its showing successful connects and publishes?

@anwarbashir
Copy link
Author

Hi, I am getting the developer at Nodecm.IO to check on AWS. There will be a delay whilst I receive a response, but this looks promising. I will get back to you hopefully on Monday, have a great weekend and many thanks for helping me with this.

@anwarbashir
Copy link
Author

Actually I am getting the same. The sketch is sending 1 message and then disconnects, can this be fixed? I am fairly sure that the 1 message is arriving, but I should know for sure by Monday.

ESP8266 AWS IoT Example
Connecting to VM575052-2G, WiFi connected, IP address: 192.168.0.9
PubSubClient connecting to: akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com. connected
Published:
Hello from ESP8266: 1
PubSubClient connecting to: akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com................................rl

@torntrousers
Copy link
Contributor

When you say "The sketch is sending 1 message and then disconnects" - does it successfully reconnect and keep sending? When I try your code it does disconnect after each publish but then reconnects, and does that for each publish. Odd that it disconnects each time though, it doesn't do that with my AWS devices.

@torntrousers
Copy link
Contributor

I've also just put up this code rewritten for an ESP32 - https://github.com/HarringayMakerSpace/awsiot/blob/master/Esp32AWSIoTExample/Esp32AWSIoTExample.ino

Do you also have an ESP32 to try?

@anwarbashir
Copy link
Author

Hi Anthony, on my ESP8266 it disconnects and does not reconnect. I will try the new code on my ESP32 and let you know...

@torntrousers
Copy link
Contributor

torntrousers commented Jan 28, 2018 •
edited
Loading

I've been trying to debug this further and I think it is AWS that is doing the disconnect. It would be interesting to see what your device policy looks like on the AWS ioT system, can you get that? The simple policy I have for testing is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}

If yours is more restrictive that could possibly be causing the disconnects.

@torntrousers
Copy link
Contributor

Hi, did you get to try this yet?

@anwarbashir
Copy link
Author

Hi, many apologies for the delay. I thought I had an ESP32 but I did not. I ordered one and it arrived this morning so I have been able try to upload your code, together with my certificates. I am unable to obtain any connection...

ESP32 AWS IoT Example
SDK version: v3.1-dev-239-g1c3dd23f-dirty
Connecting to VM575052-2G, WiFi connected, IP address: 192.168.0.8
PubSubClient connecting to: akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com.................................

In terms of the policy I will make some enquires and get back to you about the policy. Just for completeness I have povided the code that I am using below should you wish to test. I am assuming that you are able to connect using this code and your certificates?

/* ESP32 AWS IoT
*

  • Simplest possible example (that I could come up with) of using an ESP32 with AWS IoT.
  • Author: Anthony Elder
  • License: Apache License v2
    */
    #include <WiFiClientSecure.h>
    #include <PubSubClient.h> // install with Library Manager, I used v2.6.0 https://github.com/knolleary/pubsubclient/releases/tag/v2.6

const char* ssid = "ssid";
const char* password = "password";

const char* awsEndpoint = "akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com";

// Update the two certificate strings below. Paste in the text of your AWS
// device certificate and private key. Add a quote character at the start
// of each line and a backslash, n, quote, space, backslash at the end
// of each line:

// xxxxxxxxxx-certificate.pem.crt
const char* certificate_pem_crt =
//-----BEGIN CERTIFICATE----- Anwars
"MIIDWjCCAkKgAwIBAgIVAN7hovdIBJfBT3rtD2LwXUTaDZ0YMA0GCSqGSIb3DQEB"
....
"+8Mpifaz2YlaudI8c5IQhMa+N99nF4FUkBBhTyl3otCfQJddTdufxEJJKcUM9A==";
//-----END CERTIFICATE-----

// xxxxxxxxxx-private.pem.key
const char* private_pem_key =
//-----BEGIN RSA PRIVATE KEY-----Anwars
"MIIEpQIBAAKCAQEAoW79xoQM0Dz4KL62Q1iikRm2gHdkgymXTrHswKGsnLCaAJuA"
....
"d5NHw/HXoUGm2oKdkIJr6F4S6V9ITitTbYRhsaDO9nobZ/MO0otjoe8=";
//-----END RSA PRIVATE KEY-----

/* root CA can be downloaded in:
https://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSign-Class%203-Public-Primary-Certification-Authority-G5.pem
/
const char rootCA =
"-----BEGIN CERTIFICATE-----\n"
"MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB\n"
....
"4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N\n"
"hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n"
"-----END CERTIFICATE-----\n";

WiFiClientSecure wiFiClient;
void msgReceived(char* topic, byte* payload, unsigned int len);
PubSubClient pubSubClient(awsEndpoint, 8883, msgReceived, wiFiClient);

void setup() {
Serial.begin(115200); delay(50); Serial.println();
Serial.println("ESP32 AWS IoT Example");
Serial.printf("SDK version: %s\n", ESP.getSdkVersion());

Serial.print("Connecting to "); Serial.print(ssid);
WiFi.begin(ssid, password);
WiFi.waitForConnectResult();
Serial.print(", WiFi connected, IP address: "); Serial.println(WiFi.localIP());

wiFiClient.setCACert(rootCA);
wiFiClient.setCertificate(certificate_pem_crt);
wiFiClient.setPrivateKey(private_pem_key);
}

unsigned long lastPublish;
int msgCount;

void loop() {

pubSubCheckConnect();

if (millis() - lastPublish > 10000) {
String msg = String("Hello from ESP8266: ") + ++msgCount;
boolean rc = pubSubClient.publish("outTopic", msg.c_str());
Serial.print("Published, rc="); Serial.print( (rc ? "OK: " : "FAILED: ") );
Serial.println(msg);
lastPublish = millis();
}
}

void msgReceived(char* topic, byte* payload, unsigned int length) {
Serial.print("Message received on "); Serial.print(topic); Serial.print(": ");
for (int i = 0; i < length; i++) {
Serial.print((char)payload[i]);
}
Serial.println();
}

void pubSubCheckConnect() {
if ( ! pubSubClient.connected()) {
Serial.print("PubSubClient connecting to: "); Serial.print(awsEndpoint);
while ( ! pubSubClient.connected()) {
Serial.print(".");
pubSubClient.connect("ESPthingXXXX");
delay(1000);
}
Serial.println(" connected");
pubSubClient.subscribe("inTopic");
}
pubSubClient.loop();
}

@torntrousers
Copy link
Contributor

I just tried that code and it connects ok for my device. Notice though, that you have the certificate and private key not quite right in the above code. There is a subtle difference in how you define these on the ESP32 compared to the ESP8266 - the BEGIN/END CERTIFICATE strings must be included in the ESP32 but are commented out in the ESP8266. See https://github.com/HarringayMakerSpace/awsiot/blob/master/Esp32AWSIoTExample/Esp32AWSIoTExample.ino#L22-L25 compared to https://github.com/HarringayMakerSpace/awsiot/blob/master/Esp8266AWSIoTExample/Esp8266AWSIoTExample.ino#L29-L31

@anwarbashir
Copy link
Author

anwarbashir commented Feb 3, 2018 via email

@torntrousers
Copy link
Contributor

torntrousers commented Feb 3, 2018 •
edited
Loading

Great. But you still sometimes get a fail and reconnect which you can see in the line:

Published, rc=FAILED: Hello from ESP8266: 3
PubSubClient connecting to: akdo7b9q1mcdu.iot.eu-west-1.amazonaws.com.

I think thats the same as you get with your device on the ESP8266. Its odd, and I don't see those fails with my device but I do when I try your one. I've tried yours on the ESP8266 with debug on and it just shows it receiving a disconnect from AWS, I don't know if you can contact AWS and see if they can see from their logs why it disconnects.

@anwarbashir
Copy link
Author

anwarbashir commented Feb 7, 2018 via email

@jmseight
Copy link

Hi,
I am also unable to connect to the AWS IoT. I have the following:

Connecting to Amped_TAPR2_2.4, WiFi connected, IP address: 192.168.3.18
PubSubClient connecting to: aly36d4whljst.iot.us-west-2.amazonaws.com.......................................

I am using the PubSubClient v 2.6.0 by Nick O'Leary on Arduino IDE v 1.8.3

I got the AWS endpoint from the following:
HTTPS
Update your Thing Shadow using this Rest API Endpoint. Learn more
aly36d4whljst.iot.us-west-2.amazonaws.com

And downloaded the certificate and private key directly from Amazon.
a2013b102b-private.pem.key
a2013b102b-certificate.pem.crt

My thing is called:
ESPNODE

Are there some other settings that I must set on the AWS side to make this work.

Would you please be able to look at my code and see what is wrong?

Thanks,
James
ESPAWSIoTExample.ino.zip

@torntrousers
Copy link
Contributor

One thing that often gets left off is attaching a policy to the device in AWS IoT that permits the connection. Something like:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "arn:aws:iot:us-east-1:252671898597:topic/*"
    }
  ]
}

@jmseight
Copy link

jmseight commented Feb 27, 2018 •
edited
Loading

Thank you. I created and attached the policy to the certificate. But it still will not connect.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "arn:aws:iot:us-west-2:472742045374:topic/*"
    }
  ]
}

Do I need to specify the client ID or anything else on AWS side?

Best,
James

@EngineerWill
Copy link

EngineerWill commented Mar 3, 2018 •
edited
Loading

Can you run my code on your board?
I don't have to connect to the server，I can't find the reason
I Hardly set up AWS IOT, just creating a "SmartCarProject" thing
I need your help very much
please

#include <ESP8266WiFi.h>
#include <PubSubClient.h>
extern "C" {
#include "libb64/cdecode.h"
}

const char* ssid = "A1901";
const char* password = "199654yu";

const char* awsEndpoint = "a2upnp1nbdxe41.iot.us-west-2.amazonaws.com";

// For the two certificate strings below paste in the text of your AWS
// device certificate and private key, comment out the BEGIN and END
// lines, add a quote character at the start of each line and a quote
// and backslash at the end of each line:

// xxxxxxxxxx-certificate.pem.crt
const String certificatePemCrt =
//-----BEGIN CERTIFICATE-----
"MIIDWjCCAkKgAwIBAgIVANhXKgOS515o6zaFGbU2M+D9GXCUMA0GCSqGSIb3DQEB"
"CwUAME0xSzBJBgNVBAsMQkFtYXpvbiBXZWIgU2VydmljZXMgTz1BbWF6b24uY29t"
"IEluYy4gTD1TZWF0dGxlIFNUPVdhc2hpbmd0b24gQz1VUzAeFw0xODAzMDMxNzI3"
"MDJaFw00OTEyMzEyMzU5NTlaMB4xHDAaBgNVBAMME0FXUyBJb1QgQ2VydGlmaWNh"
"dGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZqCV8u0ajdv3wwdg9"
"bSsEvrmFS0HempacFvNFCwwIz+4l2lOzfNPeOmmV9a78HfoHySMJn/9lGhu/Wndm"
"tedsWH9KjlZNS0JDMnF/C59QbOzFIhrBh+c1GZ1f3b2L9516WRia+2eAKnKHUDZD"
"0i9i6jlF13LmoCURgZbhaSFOiEPT4imkjx0ZzMWZC54bCBJF7vI2ck8Ydej5VEc3"
"6IV+R8nlb4YG3fkr9LekRlMqI6JaI+QQl1JstEsjw9ZFHXnfTrgIKhn7SRPP6HrA"
"1v9nGtxjPbsSgVq66YIlgVzf5b/gr777QMtAKGSmbhxSm2k6tWfsjHeewr6AFPbB"
"eUw5AgMBAAGjYDBeMB8GA1UdIwQYMBaAFN0ERk4TQ7nQ8cXAme6Cy8lP9CGaMB0G"
"A1UdDgQWBBQJnu5lqC3SR/bfFGFgrlkkhryARzAMBgNVHRMBAf8EAjAAMA4GA1Ud"
"DwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAQEAfrMiWhfaGDzCfRCoCuvLMbFL"
"YpWTfkYl/sJaULo+pEhqU6/Dmy7KC0KSbwWkLJtWYIGX1QIXeXzYkCEaF/k2YZ/v"
"p1m7tMVCmfR8imxeCm0z7wFbUoFN51JyNnNGcjv8fNv59JAMNWJE0GtKoSXy7BzN"
"kZ+5D/o/OXXaUv4BYlWDJ+cbpr0ETP3XNa0JJnBmpFzzITOWsxROUlRtRBuNbe9X"
"csRO7Y4lpHPd/CUyOafXepkdpttEnoiosNy5AAS9fxBcgQ3AHQZd65ITyDw2cuQA"
"5bFgO4/wfOXBdUnEqUcqqIJmCkzjR0Y24iG+sOKL3ckC8pELUftK2iFZzS1pVQ==";
//-----END CERTIFICATE-----

// xxxxxxxxxx-private.pem.key
const String privatePemKey =
//-----BEGIN RSA PRIVATE KEY-----
"MIIEpAIBAAKCAQEAmaglfLtGo3b98MHYPW0rBL65hUtB3pqWnBbzRQsMCM/uJdpT"
"s3zT3jpplfWu/B36B8kjCZ//ZRobv1p3ZrXnbFh/So5WTUtCQzJxfwufUGzsxSIa"
"wYfnNRmdX929i/edelkYmvtngCpyh1A2Q9IvYuo5Rddy5qAlEYGW4WkhTohD0+Ip"
"pI8dGczFmQueGwgSRe7yNnJPGHXo+VRHN+iFfkfJ5W+GBt35K/S3pEZTKiOiWiPk"
"EJdSbLRLI8PWRR153064CCoZ+0kTz+h6wNb/ZxrcYz27EoFauumCJYFc3+W/4K++"
"+0DLQChkpm4cUptpOrVn7Ix3nsK+gBT2wXlMOQIDAQABAoIBAAghibpL/rTvuwhe"
"eZ7mg/xAS3juPpIVBBtGa6EfsIdW2XdPUlaRKHT+ClBRK+1TeMOotR3xRYaIFyfN"
"Fbxtq81j8Xh0h8SXUu5TYQYkC04qNW1JHLlZA7cfn+BOz5T0iXTL+i1ZWGTD2kOm"
"zvhPywok8trrR71EhDGk9eL/uS96mXv6BQM3bloCNyTAlaa3n1cA49QAc16cflRE"
"gsqawl36t/LijeypkW+r0RVO4cKRfdQ7bWX4cPNY5AMaBBYUELIdv3vsu0WXXhQd"
"wQ76jd5v2U4PC0hTt3KZGiCHTNQMD6Yqh9wMNjBOb7MUm7otleSr2/qmnCYNpL+Z"
"illZj3ECgYEAzLKhQRXQKf7D66DNSVkMT5xayC4dOtOMrlhNXdJ4Sy0I6uZKkcEN"
"ov/AC6Q8RUylgOTY7NysNiErL/8c790G+PETzb+K3Zb5VcCZQJBblbgshKZ9OpD9"
"J/mIsHBSGovatzB+RqFmr/+wmyp61TsIHg2rxazgNHFXIEP5po1e+V8CgYEAwCq9"
"JP82H5XTUoQ41rqB9PW94jdChgSNVI6CsyG09EiaQ0U77PLhTrMNWFr8PsXtH48v"
"Fv0oT7AWSvpHSsqyf0sPZGcE3lL9rnLUAzcBstZe3CxWsihrHephWy8GtPEPx9wH"
"GMnBI3suQ51LD6u0W9b8ANhuo66d5xMwuWblaWcCgYEAxAPGINInjR9WM3u/OR6Z"
"iF6cHBb0jJFppMYQB+j0omBUqsOt4pbwXQb0uvEheebkkWITS/YgvpDSj1qHNjX8"
"aERKh3qFGp5o0rHkzwutd9huYPQg9QVENpRgTTyxkpQb89HvCemisKRzVJLAHxIx"
"Or4yn89kvzNNkCsnlFLKAJcCgYB5YwXzttrDfOruNuOIkGvDBvAZU3rMGVgFT7gz"
"21jo7muzjqpZ9Npp0iTd6Stpo7EzvEispuGt5LdQSWR7VCsIyatBauniXl4sshBG"
"r5p9E3j8b22cQHfZf9JbvQrphVTIlK5O9DLybL8+qr9deMMHOHgbOJw6/PR1oOOo"
"Wd0UhQKBgQCyMd00ludQqhih535GIujkTGlWGDJ1d33kWysuCjAoMz4DEikS7biC"
"2rMjhVWOgB4QlO/eMCZ9AGFel/e7sR5TJvJrNyPfsGxU8R9BMaScQLs5KrIGlvl/"
"IIaaKHorkxZ/T7iUs0W4Ekxl7cPyWsxoMbgeIHOBwYBoc3+dPImcsA==";
//-----END RSA PRIVATE KEY-----

WiFiClientSecure wiFiClient;
void msgReceived(char* topic, byte* payload, unsigned int len);
PubSubClient pubSubClient(awsEndpoint, 8883, msgReceived, wiFiClient);

void setup() {
Serial.begin(115200); Serial.println();
Serial.println("ESP8266 AWS IoT Example");

Serial.print("Connecting to "); Serial.print(ssid);
WiFi.begin(ssid, password);
WiFi.waitForConnectResult();
Serial.print(", WiFi connected, IP address: "); Serial.println(WiFi.localIP());

uint8_t binaryCert[certificatePemCrt.length()];
int len = b64decode(certificatePemCrt, binaryCert);
wiFiClient.setCertificate(binaryCert, len);

uint8_t binaryPrivate[privatePemKey.length()];
len = b64decode(privatePemKey, binaryPrivate);
wiFiClient.setPrivateKey(binaryPrivate, len);

}

unsigned long lastPublish;
int msgCount;

void loop() {

pubSubCheckConnect();

if (millis() - lastPublish > 10000) {
  String msg = String("Hello from ESP8266: ") + ++msgCount;
  pubSubClient.publish("outTopic", msg.c_str());
  Serial.print("Published: "); Serial.println(msg);
  lastPublish = millis();
}

}

void msgReceived(char* topic, byte* payload, unsigned int length) {
Serial.print("Message received on "); Serial.print(topic); Serial.print(": ");
for (int i = 0; i < length; i++) {
Serial.print((char)payload[i]);
}
Serial.println();
}

void pubSubCheckConnect() {
if ( ! pubSubClient.connected()) {
Serial.print("PubSubClient connecting to: "); Serial.print(awsEndpoint);
while ( ! pubSubClient.connected()) {
Serial.print(".");
pubSubClient.connect("ESPthing");
}
Serial.println(" connected");
pubSubClient.subscribe("inTopic");
}
pubSubClient.loop();
}

int b64decode(String b64Text, uint8_t* output) {
base64_decodestate s;
base64_init_decodestate(&s);
int cnt = base64_decode_block(b64Text.c_str(), b64Text.length(), (char*)output, &s);
return cnt;
}

@romelemperado
Copy link

romelemperado commented Aug 16, 2018 •
edited
Loading

Same issue here facing disconnect problem.. I built my own mqtt broker and it works great but when I use AWS iot I'm having disconnects after publishing.. It is not usuable at all..

@torntrousers
Copy link
Contributor

I've tried this again and it still works ok for me. Check your AWS endpoint, certificates and policy.

@romelemperado
Copy link

romelemperado commented Aug 16, 2018 •
edited
Loading

I had the same issue with @anwarbashir I can connect to aws endpoint but when I publish it disconnects and reconnect again.

My policy is like this and this policy was added to my cert and my thing..

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}

By the way my way of loading the certs are via file system I converted it to .der format.. In my own mqtt broker it works 100% .. The only difference in our code is, in your code you made the client certs hardcoded in the code as string.. I don't think there is a difference if I load it via file system.. I think there is something that AWS needed we need to do to make it stable..

@torntrousers
Copy link
Contributor

Could you run try running with debug on and add what that outputs here? You turn on logging from the Arduino IDE tools menu Tools -> Debug port: Serial, and Tools -> Debug Level: SSL+TLS_MEM+HTTP_CLIENT

@romelemperado
Copy link

romelemperado commented Aug 17, 2018 •
edited
Loading

Hi

below are the logs..

=== CERTIFICATE ISSUED TO ===
Common Name (CN):		xxx.xx.com
Organization (O):		Internet Widgits Pty Ltd
Country (C):			AU
State (ST):			Philippines
=== CERTIFICATE ISSUED BY ===
Common Name (CN):		xx.xxx.com
Organization (O):		xx
Country (C):			PH
State (ST):			Some-State
Not Before:			Fri Aug 17 03:29:06 2018
Not After:			Wed Jun 16 21:00:50 1982
RSA bitsize:			2048
Sig Type:			SHA256
Loading cert returned true
scandone
state: 0 -> 2 (b0)
state: 2 -> 3 (0)
state: 3 -> 5 (10)
add 0
aid 40
cnt 

connected with FSMS, channel 11
dhcp client start...
ip:192.168.0.168,mask:255.255.255.0,gw:192.168.0.1
Attempting MQTT connection...
State:	sending Client Hello (1)
State:	receiving Server Hello (2)
State:	receiving Certificate (11)
=== CERTIFICATE ISSUED TO ===
Common Name (CN):		*.iot.us-east-1.amazonaws.com
Organization (O):		Amazon.com, Inc.
Location (L):			Seattle
Country (C):			US
State (ST):			Washington
Basic Constraints:		CA:FALSE, pathlen:10000
Key Usage:			critical, Digital Signature, Key Encipherment
Subject Alt Name:		iot.us-east-1.amazonaws.com *.iot.us-east-1.amazonaws.com 
=== CERTIFICATE ISSUED BY ===
Common Name (CN):		Symantec Class 3 Secure Server CA - G4
Organization (O):		Symantec Corporation
Organizational Unit (OU):	Symantec Trust Network
Country (C):			US
Not Before:			Mon Nov 27 00:00:00 2017
Not After:			Wed Nov 28 23:59:59 2018
RSA bitsize:			2048
Sig Type:			SHA256
=== CERTIFICATE ISSUED TO ===
Common Name (CN):		Symantec Class 3 Secure Server CA - G4
Organization (O):		Symantec Corporation
Organizational Unit (OU):	Symantec Trust Network
Country (C):			US
Basic Constraints:		critical, CA:TRUE, pathlen:0
Key Usage:			critical, Key Cert Sign, CRL Sign
Subject Alt Name:		
=== CERTIFICATE ISSUED BY ===
Common Name (CN):		VeriSign Class 3 Public Primary Certification Authority - G5
Organization (O):		VeriSign, Inc.
Organizational Unit (OU):	VeriSign Trust Network
Country (C):			US
Not Before:			Thu Oct 31 00:00:00 2013
Not After:			Mon Oct 30 23:59:59 2023
RSA bitsize:			2048
Sig Type:			SHA256
State:	receiving Certificate Request (13)
State:	receiving Server Hello Done (14)
State:	sending Certificate (11)
State:	sending Client Key Exchange (16)
State:	sending Certificate Verify (15)
State:	sending Finished (16)
State:	receiving Finished (16)
connected to MQTT server
pm open,type:2 0
pressed 1 time --> Trying to publish something 
Heap: 15928
Alert: close notify
Attempting MQTT connection...  --> As expected it's reconnecting..
State:	sending Client Hello (1)
State:	receiving Server Hello (2)
State:	receiving Certificate (11)
=== CERTIFICATE ISSUED TO ===
Common Name (CN):		*.iot.us-east-1.amazonaws.com
Organization (O):		Amazon.com, Inc.
Location (L):			Seattle
Country (C):			US
State (ST):			Washington
Basic Constraints:		CA:FALSE, pathlen:10000
Key Usage:			critical, Digital Signature, Key Encipherment
Subject Alt Name:		iot.us-east-1.amazonaws.com *.iot.us-east-1.amazonaws.com 
=== CERTIFICATE ISSUED BY ===
Common Name (CN):		Symantec Class 3 Secure Server CA - G4
Organization (O):		Symantec Corporation
Organizational Unit (OU):	Symantec Trust Network
Country (C):			US
Not Before:			Mon Nov 27 00:00:00 2017
Not After:			Wed Nov 28 23:59:59 2018
RSA bitsize:			2048
Sig Type:			SHA256
=== CERTIFICATE ISSUED TO ===
Common Name (CN):		Symantec Class 3 Secure Server CA - G4
Organization (O):		Symantec Corporation
Organizational Unit (OU):	Symantec Trust Network
Country (C):			US
Basic Constraints:		critical, CA:TRUE, pathlen:0
Key Usage:			critical, Key Cert Sign, CRL Sign
Subject Alt Name:		
=== CERTIFICATE ISSUED BY ===
Common Name (CN):		VeriSign Class 3 Public Primary Certification Authority - G5
Organization (O):		VeriSign, Inc.
Organizational Unit (OU):	VeriSign Trust Network
Country (C):			US
Not Before:			Thu Oct 31 00:00:00 2013
Not After:			Mon Oct 30 23:59:59 2023
RSA bitsize:			2048
Sig Type:			SHA256
State:	receiving Certificate Request (13)
State:	receiving Server Hello Done (14)
State:	sending Certificate (11)
State:	sending Client Key Exchange (16)
State:	sending Certificate Verify (15)
State:	sending Finished (16)
State:	receiving Finished (16)
connected to MQTT server

Look at this part the before and after.. why 1982? :)

Not Before:			Fri Aug 17 03:29:06 2018
Not After:			Wed Jun 16 21:00:50 1982

@torntrousers
Copy link
Contributor

I see. Any chance you can get the logs from the AWS IoT side - https://docs.aws.amazon.com/iot/latest/developerguide/cloud-watch-logs.html?

@mtuee
Copy link

mtuee commented Feb 6, 2022

I suspect this topic is too old now, but I'm also trying to connect with an ESP8266, and I just can't ever get past "PubSubClient connecting to:..." It just goes on and on forever. I have put my AWS endpoint in, and I can tell it's hitting it correctly because if I change any of the endpoint, the connection loop speeds up. It seems like it has to be a problem with the certificates, but I have tried every variant of populating the ESP8266 example with my certs and it just doesn't change anything.

I got it to work with this example, but I find that to be a really goofy example because you need to use OpenSSL to convert your certificates and then load them with a special 8266 uploader tool.

Why is this 8266 example never connecting?

@sborsay
Copy link

sborsay commented Feb 6, 2022 via email

@sborsay
Copy link

sborsay commented Feb 6, 2022 via email

@mtuee
Copy link

mtuee commented Feb 6, 2022 via email

@sborsay
Copy link

sborsay commented Feb 6, 2022 via email

@mtuee
Copy link

mtuee commented Feb 6, 2022 via email

@sborsay
Copy link

sborsay commented Feb 6, 2022 via email

@sborsay
Copy link

sborsay commented Feb 6, 2022 via email

@torntrousers
Copy link
Contributor

I'm happy people still find this example useful.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@romelemperado @mtuee @anwarbashir @torntrousers @sborsay @EngineerWill @jmseight