{"id":1915,"date":"2018-12-17T22:53:23","date_gmt":"2018-12-18T03:53:23","guid":{"rendered":"http:\/\/blog.espol.edu.ec\/edelros\/?p=1915"},"modified":"2022-03-24T11:30:23","modified_gmt":"2022-03-24T16:30:23","slug":"mqtt-tls-archivo-ino-para-mensajes-de-estado-led","status":"publish","type":"post","link":"https:\/\/blog.espol.edu.ec\/girni\/mqtt-tls-archivo-ino-para-mensajes-de-estado-led\/","title":{"rendered":"3.4 MQTT TLS - Archivo.ino para mensajes de estado LED"},"content":{"rendered":"

Para a\u00f1adir un nivel adicional de seguridad a los mensajes MQTT en la red, se incorpora SSL\/TLS para un dispositivo ESP8266.<\/p>\n

\"\"<\/a><\/p>\n

Para simplificar el ejemplo, la explicaci\u00f3n supone que tiene operando el dispositico con<\/p>\n

Mensajes con ESP8266-Parpadeo LED<\/a><\/p>\n

y se ha habilitado un broker SSL\/TLS con certificado \"local\" siguiendo el ejemplo de<\/p>\n

MQTT \u2013 Mosquitto TLS<\/a><\/p>\n

Librer\u00edas Arduino<\/h2>\n

Para manejar TLS en la conexi\u00f3n, se usa la libreria siguiente:<\/p>\n

#include<\/span> <WiFiClientSecure<\/span><\/b>.h>\r\n<\/pre>\n
Servidor MQTT puerto<\/h2>\n
El primer valor a actualizar para mensajes TLS es el puerto, revise este valor antes de continuar.<\/p>\n
\/\/ MQTT: Servidor\r\nchar<\/span>* MQTT_IP = \"192.168.10.40\"<\/span>;\r\nuint16_t<\/span> MQTT_puerto = 8883;\r\n<\/pre>\n
Certificados TLS<\/h2>\n
Los certificados a usar corresponden al certificado de la autoridad y del servidor mqtt.<\/p>\n
Para el certificado de la autoridad mqtt-ca.crt<\/code> se usa el contenido del archivo abierto como texto.<\/p>\n
El certificado del servidor mqtt-srv se usa en formato reducido de fingerprint, obtenido con la instruccion descrita anteriormente en la secci\u00f3n mosquitto TLS.<\/p>\n
\/\/ Certificados TLS: Certificate Authority\r\nconst char<\/span> caCert[] PROGMEM<\/span> = R\"EOF(-----BEGIN CERTIFICATE-----\r\nMIIDRzCCAi+gAwIBAgIUMtlZSXzSZfHpBI0vrnxdLrQuNgwwDQYJKoZIhvcNAQEL\r\nBQAwMzELMAkGA1UEBhMCRUMxDDAKBgNVBAcMA0d5ZTEWMBQGA1UEAwwNMTkyLjE2\r\n.... \/\/ ....\r\nOpA6IPNIHmDSSPxgejZq4booviVKro2\/M++iOUuGj1jkjR6XSQ6x1JgK0DVyiBtD\r\n4od+M4mYk7gz\/CHgl1JEsTVPyUZK4OO\/oxC7\r\n-----END CERTIFICATE-----\r\n)EOF\";\r\n\r\n\/\/ MQTT: cert SHA1 fingerprint\r\nconst uint8_t<\/span> mqttCertFingerprint[] = {0x19,0x50,0x25,0x2C,0xD8,0x6A,0x54,0xE6,0xBC,0x8B,0xA4,0x5F,0x76,0x3F,0xD0,0x7D,0xE0,0x5F,0x7C,0x6C};\r\n<\/pre>\n
Conexiones WiFi Seguras<\/h2>\n
Para usar los componentes de WifiClient y PubsubClient se requiere a\u00f1adir los detallas de los certificados, por lo que se sustituyen las l\u00ednea como se muestra:<\/p>\n
\/\/ Clientes WiFi y MQTT<\/span>\r\n\/\/WiFiClient wificlient;<\/span>\r\n\/\/ PubSubClient mqttclient(wificlient);<\/span>\r\n\r\n\/\/ X.509 parsed CA Cert <\/span>\r\nX509List<\/span><\/b> caCertX509(caCert);\r\n\/\/ Secure client connection class<\/span>\r\nWiFiClientSecure<\/span><\/b> wificlient;\r\n\/\/ MQTT: Client connection<\/span>\r\nPubSubClient<\/span><\/b> mqttclient(wificlient);\r\n<\/pre>\n
MQTT - Inicio<\/p>\n
En la secci\u00f3n de inicio de MQTT se a\u00f1aden las partes para que tome en cuenta los certificados al momento de realizar la conexi\u00f3n por Wifi<\/p>\n
  \/\/ Configura cliente TLS\r\n  \/\/ a\u00f1ade CA cert en los sitios de confianza\r\n  wificlient.setTrustAnchors<\/span>(&caCertX509);\r\n  \/\/ Habilita self-signed cert\r\n  wificlient.allowSelfSignedCerts<\/span>(); \r\n  \/\/ a\u00f1ade fingerprint para validar conexi\u00f3n\r\n  wificlient.setFingerprint<\/span>(mqttCertFingerprint); \r\n<\/pre>\n
El resto de las intrucciones se mantienen iguales al proceso anterior.<\/p>\n
\n
Ejemplo: Parpadea LED<\/h2>\n
\/* ESP8266 Sensor Parpadea. edelros@espol.edu.ec<\/span>\r\n *  con SSL\/TLS, Para usar, actualice las secciones de:<\/span>\r\n *  - WIFI:Router, MQTT:Servidor, MQTT:Dispositivo<\/span>\r\n *  ESP-01 al usar GPIO1 y GPIO3,(Tx,Rx), NO USE Serial.print()<\/span>\r\n*\/<\/span>\r\n#include<\/span> <<\/span>ESP8266WiFi<\/span>.h<\/span>><\/span>\r\n#include<\/span> <<\/span>WiFiClientSecure<\/span><\/b>.h<\/span>><\/span>\r\n#include<\/span> <<\/span>PubSubClient<\/span><\/b>.h<\/span>><\/span>\r\n\r\n\/\/ WIFI: conexi\u00f3n a Router<\/span>\r\nchar<\/span>* ssid = \"miRouter\"<\/span>;\r\nchar<\/span>* password = \"miRouterclave\"<\/span>;\r\n\r\n\/\/ MQTT: Servidor<\/span>\r\nchar<\/span>* MQTT_IP<\/span> = \"192.168.10.40\"<\/span>;\r\nuint16_t<\/span> MQTT_puerto<\/span> = 8883<\/span>;\r\nchar<\/span>* MQTT_usuario<\/span> = \"usuarioprueba\"<\/span>;\r\nchar<\/span>* MQTT_contrasena<\/span> = \"usuarioclave\"<\/span>;\r\n\r\n\/\/ MQTT: Dispositivo<\/span>\r\nchar<\/span>* MQTT_ID<\/span> = \"sensor01\"<\/span>;\r\nchar<\/span>* MQTT_TOPIC<\/span> = \"oficina\/mensaje\"<\/span>;\r\nchar<\/span> MQTT_SensorEstado<\/span>[10<\/span>] = \"OFF\"<\/span>;\r\n\r\n\/\/ Certificados TLS: Certificate Authority<\/span>\r\nconst<\/span> char<\/span> caCert<\/span>[] PROGMEM<\/span> = R<\/span>\"EOF(-----BEGIN CERTIFICATE-----<\/span>\r\nMIIDRzCCAi<\/span>+<\/span>gAwIBAgIUMtlZSXzSZfHpBI0vrnxdLrQuNgwwDQYJKoZIhvcNAQEL<\/span>\r\n.......\/\/ ........\r\nOpA6IPNIHmDSSPxgejZq4booviVKro2<\/span>\/<\/span>M<\/span>++<\/span>iOUuGj1jkjR6XSQ6x1JgK0DVyiBtD<\/span>\r\n4od<\/span>+<\/span>M4mYk7gz<\/span>\/<\/span>CHgl1JEsTVPyUZK4OO<\/span>\/<\/span>oxC7<\/span>\r\n--<\/span>--<\/span>-<\/span>END<\/span> CERTIFICATE<\/span>--<\/span>--<\/span>-<\/span>\r\n)EOF<\/span>\";<\/span>\r\n\r\n\/\/ MQTT: cert SHA1 fingerprint<\/span>\r\nconst<\/span> uint8_t<\/span> mqttCertFingerprint<\/span>[] = {0x19,0x50,0x25,0x2C,0xD8,0x6A,0x54,0xE6,0xBC,0x8B,0xA4,0x5F,0x76,0x3F,0xD0,0x7D,0xE0,0x5F,0x7C,0x6C};\r\n\r\n\/\/ Sensor <\/span>\r\nconst<\/span> uint8_t<\/span> sensor_pin<\/span> = 1<\/span>;\r\nvolatile<\/span> boolean<\/span> sensor_estado<\/span>  = false<\/span>;\r\n\r\n\/\/ LED monitor interno: ESP01-pin=1, ESP07-pin=2<\/span>\r\nconst<\/span> uint8_t<\/span> LED_pin<\/span> = 2<\/span>;\r\n\r\n\/\/ Mensajes por Puerto Serial<\/span>\r\nvolatile<\/span> boolean<\/span> serial_msg<\/span> = true<\/span>;\r\n\r\n\/\/ Clientes WiFi y MQTT<\/span>\r\n\/\/WiFiClient wificlient;<\/span>\r\n\/\/ PubSubClient mqttclient(wificlient);<\/span>\r\n\r\n\/\/ X.509 parsed CA Cert <\/span>\r\nX509List<\/span><\/b> caCertX509<\/span>(caCert<\/span>);\r\n\/\/ Secure client connection class<\/span>\r\nWiFiClientSecure<\/span><\/b> wificlient<\/span>;\r\n\/\/ MQTT: Client connection<\/span>\r\nPubSubClient<\/span><\/b> mqttclient(wificlient<\/span>);\r\n\r\nvoid<\/span> setup<\/span>() {\r\n\r\n  if<\/span> (serial_msg<\/span>){\r\n    Serial<\/span><\/b>.begin<\/span>(74880<\/span>);\/\/74880, 115200<\/span>\r\n    while<\/span> (!<\/span>Serial<\/span><\/b>){delay<\/span>(50<\/span>);}\r\n    Serial<\/span><\/b>.println<\/span>(\"inicia setup\"<\/span>);\r\n  }\r\n  \r\n  \/\/ LED monitor, Enciende en LOW<\/span>\r\n  pinMode<\/span>(LED_pin<\/span>,<\/span> OUTPUT<\/span>);\r\n\r\n  \/\/ conexi\u00f3n WIFI y MQTT<\/span>\r\n  inicia_wifi<\/span>();\r\n  if<\/span> (WiFi<\/span><\/b>.status<\/span>() == WL_CONNECTED){\r\n    inicia_mqtt<\/span>();\r\n  }\r\n}\r\n\r\nvoid<\/span> loop<\/span>() {\r\n  \r\n  \/\/ Parpadea estado de sensor<\/span>\r\n  if<\/span> (sensor_estado<\/span>==true<\/span>){\r\n    sensor_estado<\/span> = false<\/span>;\r\n  }else<\/span>{\r\n    sensor_estado<\/span> = true<\/span>;\r\n  }\r\n  \r\n  \/\/ LED Monitor Parpadea, enciende en LOW<\/span>\r\n  if<\/span> (sensor_estado<\/span> ==true<\/span>) {\r\n    digitalWrite<\/span>(LED_pin<\/span>,<\/span> LOW<\/span>);\r\n    delay<\/span>(1000); \/\/ un segundo<\/span>\r\n  }\r\n  if<\/span> (sensor_estado<\/span> ==false<\/span>) {\r\n    digitalWrite<\/span>(LED_pin<\/span>,<\/span> HIGH<\/span>);\r\n    delay<\/span>(1000);\r\n  }\r\n\r\n  if<\/span> (WiFi<\/span><\/b>.status<\/span>()==WL_CONNECTED) {\r\n    publica_estado<\/span>();\r\n  }\r\n  \r\n  \/\/Revisa estado de Wifi o reintenta conexi\u00f3n  <\/span>\r\n  if<\/span> (WiFi<\/span><\/b>.status<\/span>() !=<\/span> WL_CONNECTED){\r\n    inicia_wifi<\/span>();\r\n  }else<\/span>{\r\n    if<\/span> (mqttclient.connected<\/span>()==false<\/span>){\r\n        inicia_mqtt<\/span>(); \/\/ reintento<\/span>\r\n    }\r\n    if<\/span> (mqttclient.connected<\/span>()==true<\/span>){\r\n      mqttclient.loop<\/span>();\r\n    }\r\n  }\r\n  yield<\/span>(); \/\/ procesa wifi<\/span>\r\n} \r\n<\/pre>\n
secci\u00f3n de inicio MQTT completa:<\/p>\n
void<\/span> inicia_mqtt() {\r\n  int<\/span> intentos = 5;\r\n  int<\/span> cuenta = 0;\r\n\r\n  \/\/ Configura cliente TLS\r\n  \/\/ a\u00f1ade CA cert en los sitios de confianza\r\n  wificlient.setTrustAnchors<\/span>(&caCertX509);\r\n  \/\/ Habilita self-signed cert\r\n  wificlient.allowSelfSignedCerts<\/span>(); \r\n  \/\/ a\u00f1ade fingerprint para validar conexi\u00f3n\r\n  wificlient.setFingerprint<\/span>(mqttCertFingerprint); \r\n\r\n  mqttclient.setServer<\/span>(MQTT_IP, MQTT_puerto);\r\n  mqttclient.connect<\/span>(MQTT_ID, MQTT_usuario, MQTT_contrasena);\r\n  \/\/mqttclient.setCallback(callback);\r\n\r\n  if<\/span> (serial_msg){\r\n    Serial<\/span><\/b>.print<\/span>(\" MQTT Conectando a \"<\/span>);\r\n    Serial<\/span><\/b>.println<\/span>(MQTT_IP<\/span>);\r\n  }\r\n  \r\n  while<\/span> (!<\/span>mqttclient.connected<\/span>()&&<\/span>(cuenta<\/span><=<\/span>intentos<\/span>)){\r\n    cuenta<\/span> = cuenta<\/span> +<\/span> 1<\/span>;\r\n    \r\n    \/\/ LED Monitor parpadeo MQTT, enciende LOW\r\n    digitalWrite<\/span>(LED_pin<\/span>, LOW<\/span>);\r\n    delay<\/span>(600<\/span>);\r\n    digitalWrite<\/span>(LED_pin<\/span>, HIGH<\/span>);\r\n    delay<\/span>(400<\/span>);\r\n    \r\n    if<\/span> (serial_msg){\r\n      Serial<\/span><\/b>.print<\/span>(\".\"<\/span>);\r\n    }\r\n  }\r\n  \r\n  \/\/ Si conectado, inicializa estado\r\n  if<\/span> (mqttclient.connected<\/span>()){\r\n      publica_estado();\r\n  }\r\n  \r\n  if<\/span> (serial_msg){\r\n    \/\/Fin de \"....\"\r\n    Serial<\/span><\/b>.println<\/span>();\r\n    Serial<\/span><\/b>.print<\/span>(\"; MQTT Conectado: \";<\/span>);\r\n    Serial<\/span><\/b>.println<\/span>(mqttclient.connected<\/span>());\r\n    Serial<\/span><\/b>.print<\/span>(\"; MQTT Estado: \";<\/span>);\r\n    Serial<\/span><\/b>.println<\/span>(mqttclient.state());\r\n  }\r\n}\r\n<\/pre>\n
secci\u00f3n de publicaci\u00f3n MQTT es igual que en el ejercicio que le precede<\/p>\n
\/\/ Publicar el estados del dispositivo\r\nvoid<\/span> publica_estado() {\r\n  \r\n  \/\/ formato para envio (Texto)\r\n  if<\/span> (sensor_estado == true<\/span> ){\r\n    snprintf(MQTT_SensorEstado,10, \"ON\"<\/span>);\r\n  }else<\/span>{\r\n    snprintf(MQTT_SensorEstado,10, \"OFF\"<\/span>);\r\n  }\r\n\r\n  \/\/ publicar estados\r\n  if<\/span> (mqttclient.connected<\/span>()==true<\/span>) {\r\n    mqttclient.publish<\/span>(MQTT_TOPIC,MQTT_SensorEstado,true<\/span>);\r\n  }\r\n\r\n  if<\/span> (serial_msg){\r\n    if<\/span> (mqttclient.connected<\/span>()==true<\/span>) {\r\n      Serial<\/span><\/b>.<\/span>println<\/span>(MQTT_SensorEstado);\r\n    }\r\n    if<\/span> (mqttclient.connected<\/span>()==false<\/span>) {\r\n      Serial<\/span><\/b>.<\/span>println<\/span>(\"MQTT desconectado\"<\/span>);\r\n    }\r\n  }\r\n}\r\n<\/pre>\n
secci\u00f3n de inicio de Wifi es igual que en el ejercicio que le precede.<\/p>\n
void<\/span> inicia_wifi(){\r\n  int<\/span> intentos = 10;\r\n  int<\/span> cuenta = 0;\r\n\r\n  if<\/span> (serial_msg){\r\n    Serial.print<\/span><\/b>(\" WIFI Conectando a \"<\/span>);\r\n    Serial.println<\/span><\/b>(ssid);\r\n    }\r\n  \r\n  WiFi.mode<\/span><\/b>(WIFI_STA<\/span>);\r\n  WiFi.begin<\/span><\/b>(ssid, password);\r\n  \r\n  while<\/span> ((WiFi.status<\/span><\/b>() != WL_CONNECTED) && (cuenta < intentos)){\r\n    if<\/span> (serial_msg){\r\n      Serial.print<\/span><\/b>(\".\"<\/span>);\r\n      }\r\n    cuenta = cuenta+<\/span>1;\r\n    \/\/ Parpadeo de Monitor enciende en LOW\r\n    digitalWrite<\/span>(LED_pin, LOW<\/span>);\r\n    delay<\/span>(300);\r\n    digitalWrite<\/span>(LED_pin, HIGH<\/span>);\r\n    delay<\/span>(200);\r\n    }\r\n  \r\n  if<\/span> (serial_msg){\r\n    Serial.println<\/span><\/b>();  \/\/Fin de \"...\"<\/span>\r\n    if<\/span> (WiFi.status<\/span><\/b>() == WL_CONNECTED){\r\n      Serial.print<\/span><\/b>(\" Estado: \"<\/span>);\r\n      Serial.println<\/span><\/b>(WiFi.status<\/span>());\r\n      Serial.print<\/span><\/b>(\" MAC: \"<\/span>);\r\n      Serial.println<\/span><\/b>(WiFi.macAddress<\/span>());\r\n      Serial.print<\/span><\/b>(\" IP: \"<\/span>);\r\n      Serial.println<\/span><\/b>(WiFi.localIP<\/span>());\r\n      Serial.print<\/span><\/b>(\" RSSI: \"<\/span>);\r\n      Serial.println<\/span><\/b>(WiFi.RSSI<\/span>());\r\n      Serial.println<\/span><\/b>();\r\n      }\r\n    if<\/span> (WiFi.status<\/span><\/b>() != WL_CONNECTED){\r\n      WiFi.printDiag<\/span><\/b>(Serial<\/span>);\r\n      Serial.println<\/span><\/b>();\r\n      }\r\n    }\r\n  }\r\n<\/pre>\n
\n
Referencia<\/strong>: https:\/\/blog.thewalr.us\/2019\/03\/27\/using-esp8266-as-an-iot-endpoint-with-encrypted-mqtt-transport\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Para a\u00f1adir un nivel adicional de seguridad a los mensajes MQTT en la red, se incorpora SSL\/TLS para un dispositivo ESP8266. Para simplificar el ejemplo, la explicaci\u00f3n supone que tiene operando el dispositico con Mensajes con ESP8266-Parpadeo LED y se ha habilitado un broker SSL\/TLS con certificado \"local\" siguiendo el ejemplo de MQTT \u2013 Mosquitto … <\/p>\n
Continuar leyendo \"3.4 MQTT TLS - Archivo.ino para mensajes de estado LED\"<\/span><\/a><\/p>\n","protected":false},"author":8043,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1464959],"tags":[],"class_list":["post-1915","post","type-post","status-publish","format-standard","hentry","category-3-iot-mqtt-mensajes-de-estado-accion"],"_links":{"self":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts\/1915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/users\/8043"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/comments?post=1915"}],"version-history":[{"count":10,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts\/1915\/revisions"}],"predecessor-version":[{"id":3603,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/posts\/1915\/revisions\/3603"}],"wp:attachment":[{"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/media?parent=1915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/categories?post=1915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.espol.edu.ec\/girni\/wp-json\/wp\/v2\/tags?post=1915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}