Appendix E: Configurable MQTT TLS Certificates for Gateway-AC
Communication
1. Overview
To further improve the communication security between Cassia IoT Access Controller (AC) and Cassia Bluetooth gateway, Cassia supports configurable MQTT TLS certificates for gateway and AC communication from firmware 2.0.
The user can generate their MQTT certificate and load it in AC and gateway console. If the loaded certificate doesn’t match or expired, the gateway can’t connect to the AC. The certificate can be a CA certificate or a self-signed certificate. Cassia gateway always uses the secured MQTT to communicate with AC, no matter if the default or custom certificate is used.
NOTE
• Only PEM certificate file format is supported
• Don’t support private keys with passphrase protected
• Don’t support certificate revoke
2. AC Configuration
2.1. Open TCP port 8883 on AC Host
TCP port 8883 is used by MQTT protocol between Cassia AC and Cassia Bluetooth gateway.
The user can use NetCat to check if TCP port 8883 is enabled on AC and reachable from the gateway. Please login gateway’s local console, select Other page, and run NetCat like below.
TCP port 8883 has been opened on VMware AC. If the user wants to open TCP port 8883 for
Cassia-hosted AC, please contact Cassia support.
96 Copyright 2021 Cassia Networks, Inc.
2.3. Configure AC Time
NOTE : Please skip this step if the AC is running on the cloud, e.g., Azure or AWS because the time of the host server is always correct.
If the AC is not running on the cloud, it is recommended to switch on “Set the time automatically” and set your own NTP time servers on the AC setting page.
The AC time will be used for certificate validation. If the AC time is not configured correctly, the gateway can’t connect to the AC.
2.4. Configure MQTT Certificate
97 Copyright 2021 Cassia Networks, Inc.
On the AC Settings page, please change MQTT Certificate Configuration from Default to User
Config. Then, please fill in the CA Certificate, Server Certificate, and Server Private Key.
Default means using the default certificate provided by Cassia. The gateway and AC communication is still protected.
3. Gateway Configuration
3.1. Configure Gateway Date
Please configure the correct local date in the gateway’s local console Other tab. After connected to AC, the gateway will get the correct time from AC automatically.
The local date will be used for certificate validation. If the date is not configured correctly, the gateway can’t connect to the AC.
3.2. Configure MQTT Certificate
Please fill in MQTT certificates in the gateway Other tab. Please change Certificate
Configuration to User Config, and then fill in the CA Certificate, Client Certificate, and Client
Private Key.
NOTE
• The AC and gateways should use the same CA certificate.
• Now, we only support bi-directional authentication. It means the gateway will authenticate AC and AC will authenticate gateway too. So, both CA certificate, client certificate, and client private key should be provided on the gateway side.
98 Copyright 2021 Cassia Networks, Inc.
Now, the gateway will connect to the AC automatically.
4. Trouble Shooting and Tips
The AC and gateway console will check the integrity & validity of the certificate and private key. Please check chapter E.1 for the format requirement. If the local date and time are not configured correctly (see chapter E.2.3 and E.3.1), the validity check will fail too.
If the gateway can’t connect to the AC, please double-check if you load the correct certificate and private key. The user can set the Certificate Configuration back to Default to exclude any other issues, e.g., transport issue.
The user can find TLS error logs in the gateway console Log tab.
99 Copyright 2021 Cassia Networks, Inc.
5. Certificate and Private Key Examples
Below is an example of self-signed certificate and keys.
• ca.crt is CA certificate
• server.crt is the server certificate
• server.key is server private key
• client.crt is the client certificate
• client.key is client private key
• Don’t support private key with passphrase protected, e.g., don’t add “-des3” in step
3 and step 6
Openssl command example: openssl genrsa -des3 -out ca.key 2048 openssl req -new -x509 -key ca.key -out ca.crt -days 3650 // generate CA certificate openssl genrsa -out server.key 2048 // generate server private key openssl req -new -key server.key -out server.csr openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial out server.crt // generate server certificate openssl genrsa -out client.key 2048 // generate client private key openssl req -new -key client.key -out client.csr openssl x509 -req -days 3650 -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial out client.crt // generate client certificate ca.crt example:
-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIJALSD+kQkX3FuMA0GCSqGSIb3DQEBCwUAMFIxCzAJBgNV
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX aWRnaXRzIFB0eSBMdGQxCzAJBgNVBAMMAmRkMB4XDTE5MDUwNTAzMDk0NloXDTIw
MDUwNDAzMDk0NlowUjELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAwwCZGQw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDP+fPO92U1IHrIBvXHM5kP wB25McMpRu3CUz9SnbC/LNi8uaSZI0glevlnsU/mckVeKDizWEX6ZrtPfokN8yH2
JmwaG16AAo6jmtmam9VjVWjZeXB7bGxIi9/obl/viD9efrLamNbpldBeZEFB0ia0 p6xcCh+0Vo+268xbWdiHGnwFaFcUMhaQ0hIuHdujWguSzMLYXqATGjhZSvdkSCe+ ieUcc+y4SZTPlH+xD78MwyBxGSxMxSo6ANRjcQNIJedn2eF36dcLbVSzOEEyR2Xs
EQYBVkAyv4mFR2uFOn/j+3LR+uqEI5vAGkKw5pl5D9d9em2Ym/O5IhosOOxTzBnF
AgMBAAGjUDBOMB0GA1UdDgQWBBT5SOcADFP2P/DhdcGZRD7H96BtuTAfBgNVHSME
GDAWgBT5SOcADFP2P/DhdcGZRD7H96BtuTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3
DQEBCwUAA4IBAQAfnXfC/lMOROwv0KL8uyROtY2V1hvTjIoc1D/5zHGY7IOgLCyz
3ZRyvb3VGvVR+MPi8PHkp4X1mud/n8uVRDF+qTYvQnhxS2HF7ABxwC4Fz0JmIYAn
KYcLBgB4sUXHa8kqZiPcW8Y0GnXuT1kiYTGodfN0K6T3pXPy08Inh3IcySqwgjmh cGppJQC86LugeLFN8lB/EzQSMPpG1fyxHwlyqmsm7LNryYqr5QoS2CUc6qlc3Hc0 pu+Q15kCapJ7TS71V5hOqEtHD7XuWfhYbltAQpexw5M6udECVa3TEUWBmq86Oq6/ n0aFHK5hb2J2NhpuPAKQIUbBn7UXTd3pw1RP
-----END CERTIFICATE-----
100 Copyright 2021 Cassia Networks, Inc.
client.key example:
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvlwkLoVBJ3a/HPQ+7mcM4YuDls6txnmmV6WMhZ7BGPw+6P3Z
XzzDHRPkx8OAUSfzxUThmegNt1t6fCorESGvc9di0aFWvJB9xVQQdiocPIuZ+8Sb
Gj9m2dsmhCgn++7kea/Eusat0kVYUVnm8cMaN4/2xvrli1n4+bKZ+hGb7gV6IOuJ
XDelfRRFFANXKSBBgLSqkLxXWBT4I7DC6Cjdp9jidAmRqmuHG3923xTzkhVbBtiG bq04SB3kfb6L139nB1O2z0V/+oH0G+CkuJQ94ZF/EmfLzipv6jSY/fCMSKzcGCQZ
3j/gbEsQYAG6v/PZ1S5XE+A1nKQ87qzMrsG2HwIDAQABAoIBACWVNYOFxY5QEH1b
74zMBawGCm3c0kxMOj41rh+3bzJKovUHIUJ/UZpNEi8qdwwO0j8RUWU8fnDD+9PF
04jnWKeLT7RJoUFLWbl61mEuATMm8LjXYTP2boz2io0vDG3eBXfM7w9dKHZKQJyX
HlR/C48KulMgt+8iTVinHWVU0q9UR9+f8PTMxUThkVHh+F+BoMBhcKpXAJZruBWc oXyBlTF5T4Lt7neszHVkY6qx7E7yxVC7XY82zBExJPIu8/AzELONHT9F0DhioBJs iBPu18HK6fdLXPZDMhZX3CB0cvYSwRni5cCVLpqIcQJ5oJ6F+ZRu2xB2rPJlHBAw
I/iDJsECgYEA9IUaY7elUliz9GdrmHynh4po70AZEoOviiayww1TyEsz2ho20jDq
Svm03aemUod8sDdDwp/ajmcL3thhC3thFCVB1ZbSmq13DD269SDUK+fnr4roiv56
BVZnSdASa8rZim3qpDin7NblGVpEAiRax7Vmuy0Bi6bbhBxmF9/vL/8CgYEAx0wW
JWkaU5WR/d1MTIsnRA/u/3CJukkkbOnOZPlW9YbG7MQAWEh40tToyhqdAWC4MxS8 jAq5q10AGA83v7qIeRiFr6u8VBL02yUaxjzRvpaL10frv/VCDEA7B0YSxFd8y4xt lK4kXOzjJ5OqyO11BS00iUIGbIacN1Jcd4AneeECgYAL9TpuJ/wAw+/BAxHC+k2j
FkS9dpADVMdP5UaWvV8ci3j0sJV/v/6lPgL3WAyNOq0BXSKGMRUaI7Xz5vcP/a+o sY2/qUmRYOxSf+5VsI5Pu16cOhnXOkyzWB9i/7b26Ius9mUkNNUZgwTfMYfj5u09 mQR2IORTdQyFMHJZtozW9wKBgDO5YpIJCiUhT4eUlMXU47b9b6jqG0S20PZXZBK+ x7vnY991KyW+gWUujtBNQexmnsfbHOg3rGJ2O50C7hQbpGnRXHjwWGt1lAkAQ0ep
50HQrrCL4Pqr+51UWj2UCTDeB+yIILSS0aswa/AMmimVv2Y9ikIJWcN22DpfbNIy
94vhAoGAHNA6PAhP72+ze83Jz8ihEvpfIPJ1ekTpAsoE2EvfCtzMp+qtGV32wG3Q
IYNtsvn3/fBQGAMeDBCDjaeFH4ZRY42A+G6RURftDiOzuaCicH+d0IHez2HqY+OO wC/sPSzYUeL9EST+WsehiUzZ2SSeIZa9qWjoCRdUECsxI9ifQBk=
-----END RSA PRIVATE KEY----- client.crt example:
-----BEGIN CERTIFICATE-----
MIIDKzCCAhMCCQDgCfVlo1FF7TANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJB
VTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0 cyBQdHkgTHRkMQswCQYDVQQDDAJkZDAeFw0xOTA1MDUwNzM3NDNaFw0yMDA1MDQw
NzM3NDNaMF0xCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYD
VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxFjAUBgNVBAMMDTE5Mi4xNjgu
MC4yNDUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+XCQuhUEndr8c
9D7uZwzhi4OWzq3GeaZXpYyFnsEY/D7o/dlfPMMdE+THw4BRJ/PFROGZ6A23W3p8
KisRIa9z12LRoVa8kH3FVBB2Khw8i5n7xJsaP2bZ2yaEKCf77uR5r8S6xq3SRVhR
Webxwxo3j/bG+uWLWfj5spn6EZvuBXog64lcN6V9FEUUA1cpIEGAtKqQvFdYFPgj sMLoKN2n2OJ0CZGqa4cbf3bfFPOSFVsG2IZurThIHeR9vovXf2cHU7bPRX/6gfQb
4KS4lD3hkX8SZ8vOKm/qNJj98IxIrNwYJBneP+BsSxBgAbq/89nVLlcT4DWcpDzu rMyuwbYfAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACc9mAkv9ErVQO7v7JrxweoJ
XnYcq4jlHIo9S7x5flTou2C4GVp1231jVRjzxJs3yQ0o+Xj8WsePHLpITNZRmYOS
SnAR/AhA3tUejHbfJsDKvsjHPBdG83hJ9MhQ1friyHiWVrMxVoPrPpvynG7mKN/i
FSQlxh9bTwHtTWhBJ5X1bqOnJaz69qaumGvSIIey3IklLKJhs4LC5ADn4HHa2Xfs pRXC69CfPrYg/grTUPAY3uV/tPdTUDwCwxnvchR4bLgP4gUW6PSNvZ4MxRBx+ulx f9Z4+5j5cnmDhafUdBtE4Vs809VlfK5hgwvIy2gzZjONBLQvFKqN5duwNvr08EM=
-----END CERTIFICATE-----
101 Copyright 2021 Cassia Networks, Inc.
