Mosquitto MQTT Connection socket error (connect from PLC)

Question

I'm used to connect PLC with mosquitto broker on VPS cloud via 8883 port (secure). But this time, function block always throw 80E4 error (No valid CA found). I have checked all conditions to connect to MQTT from PLC, they are correct.

I don't think problem come from broker or TLS versions because I can connect to it by other apps with tls v1.1 and v1.2, When I try to connect with TLS v1.0 (temporary disable TLS v1.0 to test) (by mqttfx or C# app), broker show error "unsupport protocol". But when I connect from PLC, broker just show error:

"New connection from IP on port 8883. Socket error on client <'Unknown'>, disconnecting".

This socket error only happen when I connect from PLC. So, what is root cause of socket error and what should I do to find solution for problem? I use PLC s7-1500 siemens.

Thanks.

Answer 1

After manual check using wireshark, I found version of certificate is mismatch between server configuration and CPU configuration. Because CPU only support x.509 v3 certificate, but server pulish x509 v1 certificate, this is the reason why connection is crashed.

Answer 2

To establish a secured MQTT communication between the SIMATIC S7-CPU (MQTT client) and an MQTT broker in your network, the following criteria must be fulfilled:

• The MQTT broker is installed and preconfigured for the TLS process
• The required CA certificate of the MQTT broker is at hand
• The CPU's time of day has been set to the current time.

A certificate always contains a validity period during which the certificate is valid. To be able to encrypt via the certificate, the S7-CPU’s time of day also needs to be within this validity period. On a brand-new S7-CPU or after fully resetting the S7-CPU, the internal clock is set to a default value that is outside the validity period of the certificate. The certificate is then marked as invalid.

Another thing to consider is whether you have configured the MQTT broker in such a way that an MQTT client authentication is also needed, then you have to import the client certificate as well.