MQTT: Android Client Encryption

Creating an SSL/TLS Android MQTT Client

Photo by cottonbro from Pexels In this guide, we will be creating an Android MQTT client application that can send and receive messages to and from an Eclipse Mosquitto broker. It also assumes you already have a self-signed CA certificate and the corresponding files. Note that when you generate keys to work with MQTT, you shouldn’t use encryption (the -ds3 flag) for the server certificate as this creates a password-protected key which the broker can’t decode. Setting up the Broker First, we will import the certificates for the Broker to use.

Windows

Create a directory called certs in the location where Mosquitto was installed. By default, this is under

C:\Program Files\mosquitto\.

Adding certificates to Mosquitto

Secondly, we modify the mosquitto.conf file for it to support SSL/TLS support. This is done by changing the port (You can add an extra listener instead of changing the default port if you wish) and by pointing the broker to the certificate files

Change default port

SSL/TLS file paths Once that is updated, you can run the broker by typing the following command

Mosquitto Broker running with SSL/TLS configuration To verify client connections, you can test by opening a new CMD and connect a client by running the following command

Mosquitto client

Linux

Move the certificates to the Mosquitto folder as shown

$ sudo cp ca.crt /etc/mosquitto/ca_certificates/
$ sudo cp server.key /etc/mosquitto/certs/
$ sudo cp server.crt /etc/mosquitto/certs/

Create a configuration file and paste the lines below

listener 8883
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key 

Linux Mosquitto configuration Once you modify the configuration you will need to restart the Mosquitto

$ sudo systemctl restart mosquitto

Unable to start Mosquitto Note that if you are having problems restarting Mosquitto and you get this error after updating the configuration, it is possible you have the incorrect permissions for your certificates. If running as a regular user, all certificates require read permission at a user level. Then you can check the status of your broker

$ sudo systemctl status mosquitto

Mosquitto Broker successfully started

Note that certificates and keys created can be used on the Mosquitto broker/server, and also on a web server, which is the reason the term “server” is used in the Mosquitto manual and not the term of broker. Now that the broker is properly configured and is up and running we can create the Android client.

Android Client

The Android edge must have the Broker’s CA certificate inside the application when configuring the Secure Sockets Layer (SSL). For Android, the CA certificate is stored in a BKS (Bouncy Castle) file. There are 2 ways of generating and using the BKS file. Option 1, is to generate the file ourselves and import it to the project. Option 2, is to generate it programmatically using a .crt file.

Implementation 1: Importing a BKS file

In order to connect to the MQTT broker using SSL/TLS, we need a BKS file as mentioned above. One can be generated from the CA certificate, see the steps below.

Step 1 In order to generate the BKS file, the following is required: The CA Certificate of the Broker

Openssl Bouncy Castle: You can download Bouncy Castle from here. At the time of this tutorial, version is being used bcprov-jdk15to18–167.jar

Step 2 Convert the CA certificate to .PEM format.

$ openssl x509 -in cert.crt -out ca.pem

Step 3 Now, we convert the .pem certificate to .BKS by running the following commands Linux

$ keytool -import -v -trustcacerts -alias 0 -file <(openssl x509 -in “.\ca.pem”) -keystore “test.bks” -storepass test-key -storetype BKS -provider “org.bouncycastle.jce.provider.BouncyCastleProvider” -providerpath “.\bcprov-jdk15to18–167.jar”

Windows

$ keytool -import -v -trustcacerts -alias 0 -file ca.pem -keystore “test.bks” -storepass test-key -storetype BKS -provider “org.bouncycastle.jce.provider.BouncyCastleProvider” -providerpath “.\bcprov-jdk15to18–167.jar”

If successful, you should see the following output

Successfully created BKS file

Step 4

Import the .BKS file to your Android project. This can be placed under raw resources. If that directory doesn’t exist, you can create a new directory as shown below

Raw Resource directory Step 5 Setup the Android Keystore using a BKS instance, load the file we created, configure the Trust Manager Factory to trust our certificate. Finally, we create the SSL/TLS context that will be used by the MQTT client to establish the connection.

// SSL/TLS Setup
// Get the BKS Keystore type required by Android
KeyStore trustStore = KeyStore.getInstance("BKS");
// Read the BKS file we generated (droidstore.bks)
InputStream in = getResources().openRawResource(R.raw.droidstore);

trustStore.load(input, null);

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

tmf.init(trustStore);

SSLContext sslCtx = SSLContext.getInstance("TLS");
sslCtx.init(null, tmf.getTrustManagers(), null);

Step 6 Create an MQTT Client and Options object and pass the SSL/TLS context we initialized above.

// MQTT Client
// Define your server URI this needs to match the name provided
// in the CN Section of your CERT
String serverURI = "ssl://<Your_IP_OR_DOMAIN>:8883";

MqttClient client = new MqttClient(serverURI, "DroidClientExample", new MemoryPersistence());
// Create an MQTT Options object
MqttConnectOptions options = new MqttConnectOptions();
// Pass the SSL context we previously configured
options.setSocketFactory(sslCtx.getSocketFactory());
client.setCallback(this);
client.connect(options);
client.subscribe(topic);

Step 7 Send a message from your Android application

MqttMessage msg = new MqttMessage("Android SSL Message".getBytes());
try {
    client.publish("topic/SSLTest", msg);
} 
catch (MqttException e) {
    e.printStackTrace();
}
catch (MqttException e) {
    e.printStackTrace();
}

You should see the message from Android in the terminal

Successfully received MQTT message from Android device using method 1

Implementation 2: Generating a BKS file in Android

Step 1

Copy the CA certificate to your application external directory. Make sure you provide READ_EXTERNAL_STORAGE permissions to your application.

Step 2

Load the file and store it in a Certificate object.

Security.addProvider(new BouncyCastleProvider());

// Load CAs from an InputStream
CertificateFactory cf = CertificateFactory.getInstance("X.509");
File file = new File("your_ca.crt");
InputStream caIn = new BufferedInputStream(new FileInputStream(file));
Certificate ca;
try {
    // Convert crt to Certificate Java Object
    ca = cf.generateCertificate(caIn);  

}
catch {
    Log.e(TAG, "Error generating the certificate: " + e);
}
finally {
    caIn.close();
}

Step 3

Setup the Android Keystore and Trust Manager Factory to trust the certificate. Then we create the SSL/TLS context that will be used by the MQTT client to establish the connection.

// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);

// Create a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(keyStore);

// Create an SSLContext that uses our TrustManager
SSLContext sslCtx = SSLContext.getInstance("TLS");
sslCtx.init(null, tmf.getTrustManagers(), null);

Step 4

Create an MQTT Client and Options object and pass the SSL/TLS context we initialized above.

// MQTT Client
// Define your server URI this needs to match the name provided
// in the CN Section of your CERT
String serverURI = "ssl://<Your_IP_OR_DOMAIN>:8883"; 

MqttClient client = new MqttClient(serverURI, "DroidClientExample", new MemoryPersistence());
// Create an MQTT Options object
MqttConnectOptions options = new MqttConnectOptions();
options.setSocketFactory(sslCtx.getSocketFactory());
client.setCallback(this);
client.connect(options);
client.subscribe(topic);

Step 5

Send a message from your Android application

MqttMessage message = new MqttMessage("Android SSL Message".getBytes());
try {
    client.publish("topic/SSLTest", message);
} 
catch (MqttException e) {
    e.printStackTrace();
}
catch (MqttException e) {
    e.printStackTrace();
}

You should see the message from Android in the terminal

Successfully received MQTT message from Android device using method 2

Troubleshooting the Android Client

Error: TLS alert unknown ca

The server does not accept the client certificate you have send. You might be using wrong certificate.

Another reason might be that you’ve used the correct certificate but failed to add the necessary chain certificates (server.crt and server.key) You might be using the wrong Common Name (CN) defined when you created the certificate

Referensi

• https://enrq-alvarenga.medium.com/creating-an-ssl-tls-android-mqtt-client-b55a2572cf61