Security: Connect to Ubidots MQTT broker with TLS Security

In our Ubidots security guide, we explained why encryption is important for IoT and how we support two main methods for data encryption: SSL for HTTP communications, and TLS for MQTT.

MQTT is a lightweight publish/subscribe messaging transport optimized for IoT that supports TLS encryption. TLS (Transport Layer Security) provides a secure communication channel between a client and a server. Just like SSL, TLS is a cryptographic protocol that uses a handshake mechanism to create a secure connection between the client and the server. After the handshake is completed, an encrypted communication between client and server is established and no attacker could understand the content of the communication.

In this guide, we'll see how to publish MQTT messages using TLS encryption.

1. Retrieve our SSL certificate

Unlike unencrypted MQTT traffic, a TLS-powered client will need a certificate stored on its side. So let's start by storing that certificate locally by creating a new text file and entering the text below:

Then save it and give it any name, in this case "industrial.pem":

2. Install MQTT Paho

Paho is a popular MQTT client for Python, which has worked pretty well for us. You can install it using pip:

pip install paho-mqtt==1.3

For troubleshooting, or just to learn more, check out paho-mqtt page.

3. Create a Python script

Open a fresh Python file and copy the code below. Please note that:

The MQTT broker port is 8883, instead of 1883.
TLSv1.1 and TLSv1.2 are supported (in Python: ssl.PROTOCOL_TLSv1_1 and ssl.PROTOCOL_TLSv1_2).
This is a publish example, but it should work for subscribe as well. Just specify the TLS configuration before the "connect" line.
You should replace the var TLS_CERT_PATH with the path where you stored the above file with the certificate.
You should replace the MQTT_USERNAME with your own Ubidots account token.

'''
Sends data to Ubidots using MQTT over TLS

Example provided by Jose Garcia @Ubidots Developer
'''

import paho.mqtt.client as mqttClient
import time
import json
import ssl

'''
global variables
'''

connected = False  # Stores the connection status
BROKER_ENDPOINT = "industrial.api.ubidots.com"
TLS_PORT = 8883  # Secure port
MQTT_USERNAME = ""  # Put here your Ubidots TOKEN
MQTT_PASSWORD = ""  # Leave this in blank
TOPIC = "/v1.6/devices/"
DEVICE_LABEL = "truck"
TLS_CERT_PATH = "/path/to/industrial.pem"  # Put here the path of your TLS cert

'''
Functions to process incoming and outgoing streaming
'''

def on_connect(client, userdata, flags, rc):
    global connected  # Use global variable
    if rc == 0:

        print("[INFO] Connected to broker")
        connected = True  # Signal connection
    else:
        print("[INFO] Error, connection failed")


def on_publish(client, userdata, result):
    print("Published!")


def connect(mqtt_client, mqtt_username, mqtt_password, broker_endpoint, port):
    global connected

    if not connected:
        mqtt_client.username_pw_set(mqtt_username, password=mqtt_password)
        mqtt_client.on_connect = on_connect
        mqtt_client.on_publish = on_publish
        mqtt_client.tls_set(ca_certs=TLS_CERT_PATH, certfile=None,
                            keyfile=None, cert_reqs=ssl.CERT_REQUIRED,
                            tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None)
        mqtt_client.tls_insecure_set(False)
        mqtt_client.connect(broker_endpoint, port=port)
        mqtt_client.loop_start()

        attempts = 0

        while not connected and attempts < 5:  # Wait for connection
            print(connected)
            print("Attempting to connect...")
            time.sleep(1)
            attempts += 1

    if not connected:
        print("[ERROR] Could not connect to broker")
        return False

    return True


def publish(mqtt_client, topic, payload):

    try:
        mqtt_client.publish(topic, payload)

    except Exception as e:
        print("[ERROR] Could not publish data, error: {}".format(e))


def main(mqtt_client):
    payload = json.dumps({"tls_publish_test": 20})
    topic = "{}{}".format(TOPIC, DEVICE_LABEL)

    

    if not connect(mqtt_client, MQTT_USERNAME,
                   MQTT_PASSWORD, BROKER_ENDPOINT, TLS_PORT):
        return False

    publish(mqtt_client, topic, payload)

    return True


if __name__ == '__main__':
    mqtt_client = mqttClient.Client()
    while True:
        main(mqtt_client)
        time.sleep(10)

This script will send the value "20", every 10 seconds, to a device called "mqtt" inside your Ubidots account. When running the code:

python publish_singlevalue_tls.py

... You should get something like this:

Connecting...
Connected to broker
{"tls_publish_test": 20}
Published!

This example was written in Python, but any programming language supporting MQTT+TLS should offer an option to include an SSL certificate. We hope this was helpful and feel free to contact your account executive for further support.

Connect a LinkIt Smart 7688 Duo to Ubidots over MQTT

Create an MQTT Lab with Gambit Communication and Ubidots

How to Connect the Milesight Gateway to Ubidots via MQTT

UbiFunctions: Publish data to your UbiFunction using MQTT

Connect Robustel R1520 Dual-SIM Cellular VPN Router to Ubidots through MQTT