Configure Mosquitto™ broker with TLS certificate

Following my previous post, you should have now a running Mosquitto based MQTT broker on your OpenWrt router that listens on port 1883 for unsecured clients and on port 8884 for TLS PSK clients. But that's not all. I want to have the broker listen to 8883 port for TLS certificate secured clients. I will use this port for remote clients over the internet.

Of course, the port can be used for local clients that support TLS. This is the highest level of transport encryption available. It's the same encryption used by HTTPS. When you (your browser) send a HTTPS request to a server (website), the server responds with its certificate and public key. The browser has a database of trusted certificate authorities and if the authority that issued the received certificate is in that database, browser will trust the server and will respond with data encrypted with the public key. Server decrypts data with its private key. Client and server will negotiate a one time key that will be used throughout the session.

Install and configure Mosquitto™ on OpenWrt

The previous post was about MQTT security layers, the advantages of running a local MQTT server and how may a network of things be structured. The OpenWrt router should be ready to install and set up the server (broker) software. The software repositories contain two variants of the Eclipse Mosquitto software. One of them is built without SSL support. If you install that one, you won't be able to accept secure clients. The SSL enabled variant requires a bit more internal storage space and that's the main reason they provide both builds.

I'm using a router with Broadcom SoC and 16 MB of internal storage. There's still 86 percent free space after installing Mosquitto, the SSL enabled build. In this post I'll show you how to configure Mosquitto broker to listen to multiple ports and to accept clients with different security settings. This is because not all microcontrollers with network connectivity have enough processing power for TLS/SSL. And, as I said in the previous post, the devices in your local network are behind (at least one) firewall, and as long as no one else has physical access to the network, transport encryption between MQTT clients and server is not really needed. However, TLS/SSL is required for remote clients, over internet.

Run a local MQTT broker on OpenWrt router

Nowadays, microcontrollers with internet connectivity are cheap and popular. Actually, not quite internet connectivity, but network interface (mostly wireless). Also, to those MCUs that do not feature this, you can connect various network or WiFi modules (known as shields). It's now easy to connect almost anything to the big network starting from a simple LED or relay.

There are plenty of projects on this topic. Most of them make use of development boards based on Espressif platform, because they are cheap and have built-in wireless LAN connectivity. An you can run basic web servers on these that offer a web interface where you can display or change parameters from any device with web browser. But that's not what everybody needs. Sometimes, the development board is just a member in a network that includes other things too.

A common protocol was needed to allow communication between devices in the network of things. Actually, one has been around a while, way before these development boards became so cheap and available. It's the Message Queuing Telemetry Transport protocol (or MQTT), which is now an ISO standard. Used wherever small amounts of data needs to be transferred, it works on top of TCP/IP.

Arduino: interrupts in class and callback functions

Arduino is a popular open source electronics development platform. The programming language is nothing else but C/C++. The predefined Arduino libraries provide easy to use functions for most usual tasks, like writing and reading to MCU pins, data transfer using common protocols etc.

If you're working on a complex project or you are developing your own library, chances are you are creating new classes. That's because a class can contain member data (just like data structures) and member functions (which modify, process or generate data). Access to class members is usually governed by an access specifier. Private members are accessible only from within other members of the same class, while public members can be accessed from anywhere where the class object is visible. This is the C/C++ programming language. If you're not familiar with it I suggest starting with this tutorial about classes.

Arduino Library for SX8646 Capacitive Button Controller

The router front panel with LCD I began interfacing has a capacitive five button keypad. The panel I'm talking about was used by Sercomm SHG1500 routers and although there are multiple hardware versions of the LCD (some make use of FPGA circuits to drive the LCD, others use SPI interface), the keypad seems to be the same. Based on Semtech SX8646, it is controlled over I²C bus.

SX8646 requires 3.3 V power and is not compatible with 5 V bus. Besides I²C, it uses another pin to trigger an interrupt at host when a button is touched. The keypad PCB sits next to LCD PCB and on some hardware versions it plugs straight into it, while on others it uses a connection cable going to the router main board.

SX8646 keypad PCB

Arduino Library for HX8347-I Router Front Panel LCD

A while ago I managed to wire the front panel of a Sercomm router to a STM32 blue pill development board and I have attempted to control the color 2.8" LCD and the capacitive keypad found on the front panel of this type of router. Long story short: if you own a discarded Sercomm SHG1500 router that reports LCDv6 "gateway hardware version", this is the front panel you can control. OpenWrt can't be currently installed on these routers and there is no known way of changing their firmware or having access to bootloader.

But the front panel can be a great module if you're into electronics. It has a 2.8 inch LCD and a 5 keys capacitive keypad next to it. Hardware version LCDv6 uses a HX8347-I based LCD with SPI write only interface. The keypad uses I²C bus and an additional pin to trigger an interrupt when a key is touched. More on that in another post. Interfacing the front panel to common 2.54 mm pinheaders is not straightforward since it uses a 2x15 pinheader with 1.27 mm pitch. But I built an adapter you can find in the other post.

Truly HX8347-I LCD showing the SMPTE pattern