MQTTnet TLS 1.2 Encrypted Server

Question

I'm trying to create TLS 1.2-encrypted broker and clients with MQTTnet (let's say on port 2000). Below is my attempt:

using MQTTnet;
using MQTTnet.Client;
using MQTTnet.Server;
using System.Security.Authentication;

MqttFactory factory = new MqttFactory();
MqttServerOptionsBuilder serverOptions = new MqttServerOptionsBuilder()
                        .WithEncryptedEndpoint()
                        .WithEncryptedEndpointPort(2000)
                        .WithEncryptionSslProtocol(SslProtocols.Tls12)
                        .WithoutDefaultEndpoint();
MqttServer mqttServer = factory.CreateMqttServer(serverOptions.Build());
mqttServer.StartAsync();

MqttClientOptionsBuilder clientOptions = new MqttClientOptionsBuilder()
                    .WithClientId("myClient")
                    .WithTcpServer("localhost", 2000)
                    .WithTls(new MqttClientOptionsBuilderTlsParameters()
                    {
                        UseTls = true,
                        SslProtocol = SslProtocols.Tls12,
                        CertificateValidationHandler = x => { return true; }
                    });
MQTTnet.Client.MqttClient mqttClient = factory.CreateMqttClient() as MQTTnet.Client.MqttClient;
while (!mqttClient.IsConnected)
{
    mqttClient.ConnectAsync(clientOptions.Build()).GetAwaiter();
    Thread.Sleep(1000);
}
Console.WriteLine("Connected");
Console.ReadLine();

The client I created doesn't connect to the broker. I believe the problem comes from the server side (if not both), as nothing is connected on port 2000 when I check with netstat.

What did I miss?

You are not waiting for the server to start before trying to connect the client. try adding `await` before `mqttServer.StartAsync();` — hardillb, Aug 18 '22 at 21:35
Tried that, it throws an exception and says 'TLS certificate not set'. Works after adding ```.WithEncryptionCertificate()``` with a valid ```X509Certificate2```. Thanks a lot! — sfeng, Aug 19 '22 at 12:19

score 1 · Answer 1 · answered Aug 22 '22 at 16:47

Here's the code that works for me. Basically after awaiting the server and adding a X509 certificate the server now allows clients with the same certificate to connect.

using MQTTnet;
using MQTTnet.Client;
using MQTTnet.Server;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;

X509Store store = new X509Store(StoreLocation.CurrentUser);
X509Certificate2 certificate;
try
{
    store.Open(OpenFlags.ReadOnly);
    X509Certificate2Collection certCollection = store.Certificates;
    X509Certificate2Collection currentCerts = certCollection.Find(X509FindType.FindByTimeValid, DateTime.Now, false);
    certificate = currentCerts[0];
}
finally
{
    store.Close();
}
MqttFactory factory = new MqttFactory();
MqttServerOptionsBuilder serverOptions = new MqttServerOptionsBuilder()
                        .WithEncryptedEndpoint()
                        .WithEncryptedEndpointPort(2000)
                        .WithEncryptionCertificate(certificate)
                        .WithRemoteCertificateValidationCallback( (obj, cert, chain, ssl) => { return true; } )
                        .WithEncryptionSslProtocol(SslProtocols.Tls12)
                        .WithoutDefaultEndpoint();
MqttServer mqttServer = factory.CreateMqttServer(serverOptions.Build());
await mqttServer.StartAsync();

MqttClientOptionsBuilder clientOptions = new MqttClientOptionsBuilder()
                    .WithClientId("myClient")
                    .WithTcpServer("localhost", 2000)
                    .WithTls(new MqttClientOptionsBuilderTlsParameters()
                    {
                        UseTls = true,
                        SslProtocol = SslProtocols.Tls12,
                        CertificateValidationHandler = x => { return true; }
                    });
MQTTnet.Client.MqttClient mqttClient = factory.CreateMqttClient() as MQTTnet.Client.MqttClient;
while (!mqttClient.IsConnected)
{
    mqttClient.ConnectAsync(clientOptions.Build()).GetAwaiter();
    Thread.Sleep(1000);
}
Console.WriteLine("Connected");
Console.ReadLine();

MQTTnet TLS 1.2 Encrypted Server

1 Answers1