eclipse-paho / eclipse-paho/paho.mqtt.python

Using Paho 2.+ in Python for MQTT with TPM

Open
#869 1 comment 0 reactions 0 assignees View on GitHub
Status: Available
Dominant language
Python
Stars
2.4k
Forks
742
Avg merge
12d 48m
Merged PRs (30d)
1

Description

In our project we need to secure the MQTT communication with Trusted Plattform Module. The paho script for a MQTT communication with a Iot broker is working, but with TPM is failing.
Meaning errors like:
Setting of the TLS connection failed. Exception = [SSL] PEM lib (_ssl.c:3916)
are popping up.

No connection with a device certificate generated from a local private key (generated with TPM) can be established.

Questions: #
1) is paho even capable to handle TPM backed connections in this version (Paho 2.0.0)?

2) If yes what is right general workflow for accomplishing that?

The current workflow is rather now:

a) generate a TPM key on the device
export OPENSSL_CONF=/etc/ssl/openssl-tpm.cnf
openssl ecparam -name prime256v1 -genkey -out client-private-tpm2.key

b) generate a csr file from the tpm key on the devkit
openssl req -new -SHA256 -key client-private-tpm2.key -out client-private-tpm2.csr

c) generate a device certificate in the onboarding system with the client-private-tpm2.csrfile
device-certificate.crt

Problem: no connection can be established.
Error:
Setting of the TLS connection failed. Exception = [SSL] PEM lib (_ssl.c:3916)

Some prerequisites:
The python (3.10.5) script with installed running TPM2.0 and Paho library It's running on a raspberry pi with a yocto linux version (Scarthgap).
The script with the Paho library is working fine without TPM. The MQTT server/broker is in a company AWS cloud and it's working
so far with the version without TPM.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.