Root certificates work for port 443, but not for port 8883 (MQTTS)

[tbobek]

uploading root certificate of www.google.com:443 on an Arduino MKR Wifi 1010 and connecting afterwards to it with the example WifiSSLClient works perfectly.
But all my trials to connect via port 8883 TLS encrypted with a ca_certificate failed. I tried a local MQTTS-Broker and also the test.mosquitto.org broker. Uploading certificates onto the board for the domains

• test.mosquitto.org:443
• test.mosquitt.org:8883
• mosquitto.org (which defaults to mosquitto.org:443)

finished with no errors, but the connection fails. It shows a -2 error code when asking with MqttClient.connectError() for it. The MqttClient object is derived from BearSSLClient.

I also posted this issue in the arduino.cc forum:
https://forum.arduino.cc/t/mqtts-with-arduino-mkr-wifi-1010/1094414

[aentinger]

Not sure, but possibly an issue with SNI? Try using the setInsecure API to see if it solves your problem, then fix the underlying SNI issue.

[manchoz]

Hi @ffontaine, you need to create your own TAs starting from the mosquitto.org certificate using the brssl tool and use the extended begin constructor to initialize the BearSSL object. Take a look at [ArduinoBearSSL - adding root certificates](https://forum.arduino.cc/t/arduinobearssl-adding-root-certificates/610184/2).

[manchoz]

For future reference:

The full command is something like:

brssl ta my_tas_and_certs.pem > MyTAs.h

Then, add MyTAs.h file to the sketch folder/project and use the TAs array in the constructor of the BearSSLClient object:

#include "MyTAs.h"

WiFiClient client;
BearSSLClient sslClient(client, TAs, TAs_NUM);