{"id":1915,"date":"2018-12-18T22:53:23","date_gmt":"2018-12-19T03:53:23","guid":{"rendered":"http:\/\/blog.espol.edu.ec\/edelros\/?p=1915"},"modified":"2026-07-23T11:37:56","modified_gmt":"2026-07-23T16:37:56","slug":"iot-mqtt-tls","status":"publish","type":"post","link":"https:\/\/blog.espol.edu.ec\/girni\/iot-mqtt-tls\/","title":{"rendered":"4. IoT MQTT - TLS certificados"},"content":{"rendered":"\n

Para a\u00f1adir un nivel adicional de seguridad a los mensajes MQTT en la red, se incorpora SSL\/TLS para un dispositivo ESP8266.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Para simplificar el ejemplo, la explicaci\u00f3n supone que tiene operando el dispositivo con<\/p>\n\n\n\n

Mensajes con ESP8266-Parpadeo LED<\/a><\/p>\n\n\n\n

y se ha habilitado un broker SSL\/TLS con certificado \"local\" siguiendo el ejemplo de<\/p>\n\n\n\n

MQTT \u2013 Mosquitto TLS<\/a><\/p>\n\n\n\n

Librer\u00edas Arduino<\/h2>\n\n\n\n

Para manejar TLS en la conexi\u00f3n, se usa la libreria siguiente:<\/p>\n\n\n\n

#include<\/span> <WiFiClientSecure<\/span><\/b>.h>\n<\/code><\/pre>\n\n\n\n
Servidor MQTT puerto<\/h2>\n\n\n\n
El primer valor a actualizar para mensajes TLS es el puerto, revise este valor antes de continuar.<\/p>\n\n\n\n
\/\/ MQTT: Servidor\nchar<\/span>* MQTT_IP = \"192.168.10.40\"<\/span>;\nuint16_t<\/span> MQTT_puerto = 8883;\n<\/code><\/pre>\n\n\n\n
Certificados TLS<\/h2>\n\n\n\n
Los certificados a usar corresponden al certificado de la autoridad y del servidor mqtt.<\/p>\n\n\n\n
Para el certificado de la autoridad mqtt-ca.crt<\/code> se usa el contenido del archivo abierto como texto.<\/p>\n\n\n\n
El certificado del servidor mqtt-srv se usa en formato reducido de fingerprint, obtenido con la instruccion descrita anteriormente en la secci\u00f3n mosquitto TLS.<\/p>\n\n\n\n
\/\/ Certificados TLS: Certificate Authority\nconst char<\/span> caCert[] PROGMEM<\/span> = R\"EOF(-----BEGIN CERTIFICATE-----\nMIIDRzCCAi+gAwIBAgIUMtlZSXzSZfHpBI0vrnxdLrQuNgwwDQYJKoZIhvcNAQEL\nBQAwMzELMAkGA1UEBhMCRUMxDDAKBgNVBAcMA0d5ZTEWMBQGA1UEAwwNMTkyLjE2\n.... \/\/ ....\nOpA6IPNIHmDSSPxgejZq4booviVKro2\/M++iOUuGj1jkjR6XSQ6x1JgK0DVyiBtD\n4od+M4mYk7gz\/CHgl1JEsTVPyUZK4OO\/oxC7\n-----END CERTIFICATE-----\n)EOF\";\n\n\/\/ MQTT: cert SHA1 fingerprint\nconst uint8_t<\/span> mqttCertFingerprint[] = {0x19,0x50,0x25,0x2C,0xD8,0x6A,0x54,0xE6,0xBC,0x8B,0xA4,0x5F,0x76,0x3F,0xD0,0x7D,0xE0,0x5F,0x7C,0x6C};\n<\/code><\/pre>\n\n\n\n
Conexiones WiFi Seguras<\/h2>\n\n\n\n
Para usar los componentes de WifiClient y PubsubClient se requiere a\u00f1adir los detallas de los certificados, por lo que se sustituyen las l\u00ednea como se muestra:<\/p>\n\n\n\n
\/\/ Clientes WiFi y MQTT<\/span>\n\/\/WiFiClient wificlient;<\/span>\n\/\/ PubSubClient mqttclient(wificlient);<\/span>\n\n\/\/ X.509 parsed CA Cert <\/span>\nX509List<\/span><\/b> caCertX509(caCert);\n\/\/ Secure client connection class<\/span>\nWiFiClientSecure<\/span><\/b> wificlient;\n\/\/ MQTT: Client connection<\/span>\nPubSubClient<\/span><\/b> mqttclient(wificlient);\n<\/code><\/pre>\n\n\n\n
MQTT - Inicio<\/p>\n\n\n\n
En la secci\u00f3n de inicio de MQTT se a\u00f1aden las partes para que tome en cuenta los certificados al momento de realizar la conexi\u00f3n por Wifi<\/p>\n\n\n\n
  \/\/ Configura cliente TLS\n  \/\/ a\u00f1ade CA cert en los sitios de confianza\n  wificlient.setTrustAnchors<\/span>(&caCertX509);\n  \/\/ Habilita self-signed cert\n  wificlient.allowSelfSignedCerts<\/span>(); \n  \/\/ a\u00f1ade fingerprint para validar conexi\u00f3n\n  wificlient.setFingerprint<\/span>(mqttCertFingerprint); \n<\/code><\/pre>\n\n\n\n
El resto de las instrucciones se mantienen iguales al proceso anterior.<\/p>\n\n\n\n
\n\n\n\n
Ejemplo: Parpadea LED<\/h2>\n\n\n\n
\/* ESP8266 Sensor Parpadea. edelros@espol.edu.ec<\/span>\n *  con SSL\/TLS, Para usar, actualice las secciones de:<\/span>\n *  - WIFI:Router, MQTT:Servidor, MQTT:Dispositivo<\/span>\n *  ESP-01 al usar GPIO1 y GPIO3,(Tx,Rx), NO USE Serial.print()<\/span>\n*\/<\/span>\n#include<\/span> <<\/span>ESP8266WiFi<\/span>.h<\/span>><\/span>\n#include<\/span> <<\/span>WiFiClientSecure<\/span><\/b>.h<\/span>><\/span>\n#include<\/span> <<\/span>PubSubClient<\/span><\/b>.h<\/span>><\/span>\n\n\/\/ WIFI: conexi\u00f3n a Router<\/span>\nchar<\/span>* ssid = \"miRouter\"<\/span>;\nchar<\/span>* password = \"miRouterclave\"<\/span>;\n\n\/\/ MQTT: Servidor<\/span>\nchar<\/span>* MQTT_IP<\/span> = \"192.168.10.40\"<\/span>;\nuint16_t<\/span> MQTT_puerto<\/span> = 8883<\/span>;\nchar<\/span>* MQTT_usuario<\/span> = \"usuarioprueba\"<\/span>;\nchar<\/span>* MQTT_contrasena<\/span> = \"usuarioclave\"<\/span>;\n\n\/\/ MQTT: Dispositivo<\/span>\nchar<\/span>* MQTT_ID<\/span> = \"sensor01\"<\/span>;\nchar<\/span>* MQTT_TOPIC<\/span> = \"oficina\/mensaje\"<\/span>;\nchar<\/span> MQTT_SensorEstado<\/span>[10<\/span>] = \"OFF\"<\/span>;\n\n\/\/ Certificados TLS: Certificate Authority<\/span>\nconst<\/span> char<\/span> caCert<\/span>[] PROGMEM<\/span> = R<\/span>\"EOF(-----BEGIN CERTIFICATE-----<\/span>\nMIIDRzCCAi<\/span>+<\/span>gAwIBAgIUMtlZSXzSZfHpBI0vrnxdLrQuNgwwDQYJKoZIhvcNAQEL<\/span>\n.......\/\/ ........\nOpA6IPNIHmDSSPxgejZq4booviVKro2<\/span>\/<\/span>M<\/span>++<\/span>iOUuGj1jkjR6XSQ6x1JgK0DVyiBtD<\/span>\n4od<\/span>+<\/span>M4mYk7gz<\/span>\/<\/span>CHgl1JEsTVPyUZK4OO<\/span>\/<\/span>oxC7<\/span>\n--<\/span>--<\/span>-<\/span>END<\/span> CERTIFICATE<\/span>--<\/span>--<\/span>-<\/span>\n)EOF<\/span>\";<\/span>\n\n\/\/ MQTT: cert SHA1 fingerprint<\/span>\nconst<\/span> uint8_t<\/span> mqttCertFingerprint<\/span>[] = {0x19,0x50,0x25,0x2C,0xD8,0x6A,0x54,0xE6,0xBC,0x8B,0xA4,0x5F,0x76,0x3F,0xD0,0x7D,0xE0,0x5F,0x7C,0x6C};\n\n\/\/ Sensor <\/span>\nconst<\/span> uint8_t<\/span> sensor_pin<\/span> = 1<\/span>;\nvolatile<\/span> boolean<\/span> sensor_estado<\/span>  = false<\/span>;\n\n\/\/ LED monitor interno: ESP01-pin=1, ESP07-pin=2<\/span>\nconst<\/span> uint8_t<\/span> LED_pin<\/span> = 2<\/span>;\n\n\/\/ Mensajes por Puerto Serial<\/span>\nvolatile<\/span> boolean<\/span> serial_msg<\/span> = true<\/span>;\n\n\/\/ Clientes WiFi y MQTT<\/span>\n\/\/WiFiClient wificlient;<\/span>\n\/\/ PubSubClient mqttclient(wificlient);<\/span>\n\n\/\/ X.509 parsed CA Cert <\/span>\nX509List<\/span><\/b> caCertX509<\/span>(caCert<\/span>);\n\/\/ Secure client connection class<\/span>\nWiFiClientSecure<\/span><\/b> wificlient<\/span>;\n\/\/ MQTT: Client connection<\/span>\nPubSubClient<\/span><\/b> mqttclient(wificlient<\/span>);\n\nvoid<\/span> setup<\/span>() {\n\n  if<\/span> (serial_msg<\/span>){\n    Serial<\/span><\/b>.begin<\/span>(74880<\/span>);\/\/74880, 115200<\/span>\n    while<\/span> (!<\/span>Serial<\/span><\/b>){delay<\/span>(50<\/span>);}\n    Serial<\/span><\/b>.println<\/span>(\"inicia setup\"<\/span>);\n  }\n  \n  \/\/ LED monitor, Enciende en LOW<\/span>\n  pinMode<\/span>(LED_pin<\/span>,<\/span> OUTPUT<\/span>);\n\n  \/\/ conexi\u00f3n WIFI y MQTT<\/span>\n  inicia_wifi<\/span>();\n  if<\/span> (WiFi<\/span><\/b>.status<\/span>() == WL_CONNECTED){\n    inicia_mqtt<\/span>();\n  }\n}\n\nvoid<\/span> loop<\/span>() {\n  \n  \/\/ Parpadea estado de sensor<\/span>\n  if<\/span> (sensor_estado<\/span>==true<\/span>){\n    sensor_estado<\/span> = false<\/span>;\n  }else<\/span>{\n    sensor_estado<\/span> = true<\/span>;\n  }\n  \n  \/\/ LED Monitor Parpadea, enciende en LOW<\/span>\n  if<\/span> (sensor_estado<\/span> ==true<\/span>) {\n    digitalWrite<\/span>(LED_pin<\/span>,<\/span> LOW<\/span>);\n    delay<\/span>(1000); \/\/ un segundo<\/span>\n  }\n  if<\/span> (sensor_estado<\/span> ==false<\/span>) {\n    digitalWrite<\/span>(LED_pin<\/span>,<\/span> HIGH<\/span>);\n    delay<\/span>(1000);\n  }\n\n  if<\/span> (WiFi<\/span><\/b>.status<\/span>()==WL_CONNECTED) {\n    publica_estado<\/span>();\n  }\n  \n  \/\/Revisa estado de Wifi o reintenta conexi\u00f3n  <\/span>\n  if<\/span> (WiFi<\/span><\/b>.status<\/span>() !=<\/span> WL_CONNECTED){\n    inicia_wifi<\/span>();\n  }else<\/span>{\n    if<\/span> (mqttclient.connected<\/span>()==false<\/span>){\n        inicia_mqtt<\/span>(); \/\/ reintento<\/span>\n    }\n    if<\/span> (mqttclient.connected<\/span>()==true<\/span>){\n      mqttclient.loop<\/span>();\n    }\n  }\n  yield<\/span>(); \/\/ procesa wifi<\/span>\n} <\/code><\/pre>\n\n\n\n
secci\u00f3n de inicio MQTT completa:<\/p>\n\n\n\n
void<\/span> inicia_mqtt() {\n  int<\/span> intentos = 5;\n  int<\/span> cuenta = 0;\n\n  \/\/ Configura cliente TLS\n  \/\/ a\u00f1ade CA cert en los sitios de confianza\n  wificlient.setTrustAnchors<\/span>(&caCertX509);\n  \/\/ Habilita self-signed cert\n  wificlient.allowSelfSignedCerts<\/span>(); \n  \/\/ a\u00f1ade fingerprint para validar conexi\u00f3n\n  wificlient.setFingerprint<\/span>(mqttCertFingerprint); \n\n  mqttclient.setServer<\/span>(MQTT_IP, MQTT_puerto);\n  mqttclient.connect<\/span>(MQTT_ID, MQTT_usuario, MQTT_contrasena);\n  \/\/mqttclient.setCallback(callback);\n\n  if<\/span> (serial_msg){\n    Serial<\/span><\/b>.print<\/span>(\" MQTT Conectando a \"<\/span>);\n    Serial<\/span><\/b>.println<\/span>(MQTT_IP<\/span>);\n  }\n  \n  while<\/span> (!<\/span>mqttclient.connected<\/span>()&&<\/span>(cuenta<\/span><=<\/span>intentos<\/span>)){\n    cuenta<\/span> = cuenta<\/span> +<\/span> 1<\/span>;\n    \n    \/\/ LED Monitor parpadeo MQTT, enciende LOW\n    digitalWrite<\/span>(LED_pin<\/span>, LOW<\/span>);\n    delay<\/span>(600<\/span>);\n    digitalWrite<\/span>(LED_pin<\/span>, HIGH<\/span>);\n    delay<\/span>(400<\/span>);\n    \n    if<\/span> (serial_msg){\n      Serial<\/span><\/b>.print<\/span>(\".\"<\/span>);\n    }\n  }\n  \n  \/\/ Si conectado, inicializa estado\n  if<\/span> (mqttclient.connected<\/span>()){\n      publica_estado();\n  }\n  \n  if<\/span> (serial_msg){\n    \/\/Fin de \"....\"\n    Serial<\/span><\/b>.println<\/span>();\n    Serial<\/span><\/b>.print<\/span>(\"; MQTT Conectado: \";<\/span>);\n    Serial<\/span><\/b>.println<\/span>(mqttclient.connected<\/span>());\n    Serial<\/span><\/b>.print<\/span>(\"; MQTT Estado: \";<\/span>);\n    Serial<\/span><\/b>.println<\/span>(mqttclient.state());\n  }\n}<\/code><\/pre>\n\n\n\n
secci\u00f3n de publicaci\u00f3n MQTT es igual que en el ejercicio que le precede<\/p>\n\n\n\n
\/\/ Publicar el estados del dispositivo\nvoid<\/span> publica_estado() {\n  \n  \/\/ formato para envio (Texto)\n  if<\/span> (sensor_estado == true<\/span> ){\n    snprintf(MQTT_SensorEstado,10, \"ON\"<\/span>);\n  }else<\/span>{\n    snprintf(MQTT_SensorEstado,10, \"OFF\"<\/span>);\n  }\n\n  \/\/ publicar estados\n  if<\/span> (mqttclient.connected<\/span>()==true<\/span>) {\n    mqttclient.publish<\/span>(MQTT_TOPIC,MQTT_SensorEstado,true<\/span>);\n  }\n\n  if<\/span> (serial_msg){\n    if<\/span> (mqttclient.connected<\/span>()==true<\/span>) {\n      Serial<\/span><\/b>.<\/span>println<\/span>(MQTT_SensorEstado);\n    }\n    if<\/span> (mqttclient.connected<\/span>()==false<\/span>) {\n      Serial<\/span><\/b>.<\/span>println<\/span>(\"MQTT desconectado\"<\/span>);\n    }\n  }\n}<\/code><\/pre>\n\n\n\n
secci\u00f3n de inicio de Wifi es igual que en el ejercicio que le precede.<\/p>\n\n\n\n
void<\/span> inicia_wifi(){\n  int<\/span> intentos = 10;\n  int<\/span> cuenta = 0;\n\n  if<\/span> (serial_msg){\n    Serial.print<\/span><\/b>(\" WIFI Conectando a \"<\/span>);\n    Serial.println<\/span><\/b>(ssid);\n    }\n  \n  WiFi.mode<\/span><\/b>(WIFI_STA<\/span>);\n  WiFi.begin<\/span><\/b>(ssid, password);\n  \n  while<\/span> ((WiFi.status<\/span><\/b>() != WL_CONNECTED) && (cuenta < intentos)){\n    if<\/span> (serial_msg){\n      Serial.print<\/span><\/b>(\".\"<\/span>);\n      }\n    cuenta = cuenta+<\/span>1;\n    \/\/ Parpadeo de Monitor enciende en LOW\n    digitalWrite<\/span>(LED_pin, LOW<\/span>);\n    delay<\/span>(300);\n    digitalWrite<\/span>(LED_pin, HIGH<\/span>);\n    delay<\/span>(200);\n    }\n  \n  if<\/span> (serial_msg){\n    Serial.println<\/span><\/b>();  \/\/Fin de \"...\"<\/span>\n    if<\/span> (WiFi.status<\/span><\/b>() == WL_CONNECTED){\n      Serial.print<\/span><\/b>(\" Estado: \"<\/span>);\n      Serial.println<\/span><\/b>(WiFi.status<\/span>());\n      Serial.print<\/span><\/b>(\" MAC: \"<\/span>);\n      Serial.println<\/span><\/b>(WiFi.macAddress<\/span>());\n      Serial.print<\/span><\/b>(\" IP: \"<\/span>);\n      Serial.println<\/span><\/b>(WiFi.localIP<\/span>());\n      Serial.print<\/span><\/b>(\" RSSI: \"<\/span>);\n      Serial.println<\/span><\/b>(WiFi.RSSI<\/span>());\n      Serial.println<\/span><\/b>();\n      }\n    if<\/span> (WiFi.status<\/span><\/b>() != WL_CONNECTED){\n      WiFi.printDiag<\/span><\/b>(Serial<\/span>);\n      Serial.println<\/span><\/b>();\n      }\n    }\n  }\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Referencia<\/strong>: https:\/\/blog.thewalr.us\/2019\/03\/27\/using-esp8266-as-an-iot-endpoint-with-encrypted-mqtt-transport\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Para a\u00f1adir un nivel adicional de seguridad a los mensajes MQTT en la red, se incorpora SSL\/TLS para un dispositivo ESP8266. Para simplificar el ejemplo, la explicaci\u00f3n supone que tiene operando el dispositivo con Mensajes con ESP8266-Parpadeo LED y se ha habilitado un broker SSL\/TLS con certificado \"local\" siguiendo el ejemplo de MQTT \u2013 Mosquitto […]<\/p>\n","protected":false},"author":8043,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1464959],"tags":[],"class_list":["post-1915","post","type-post","status-publish","format-standard","hentry","category-iot-mensajes"],"_links":{"self":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts\/1915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/users\/8043"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/comments?post=1915"}],"version-history":[{"count":14,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts\/1915\/revisions"}],"predecessor-version":[{"id":4386,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts\/1915\/revisions\/4386"}],"wp:attachment":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/media?parent=1915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/categories?post=1915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/tags?post=1915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}