Use MQTT.fx to connect a device to an MQTT gateway for one-party and third-party verification - IoT Platform - Alibaba Cloud - IoT Platform

Prerequisites

Purchase an Enterprise Edition instance. This tutorial uses an Exclusive Enterprise Edition instance in the China (Shanghai) region.
Download and install the MQTT.fx software. For instructions, see MQTT.fx.

Because third-party software is updated regularly, your UI may differ.
Generate a custom certificate.

This tutorial requires a custom certificate that includes a root certificate (root-ca.crt), a server-side private key (server.key), and a server certificate (server.crt).

You can use OpenSSL to generate the certificate. For more information, see Generate a custom certificate.

Background information

MQTT.fx is an MQTT client based on Eclipse Paho and written in Java. It supports Windows, macOS, and Linux. You can use MQTT.fx to verify that a device can connect to IoT Platform and communicate via topics.

Devices can use either method with features like custom certificates, server-side authentication, and custom topics to connect to and communicate with IoT Platform.

For more information about device authentication and communication for an MQTT cloud gateway, see Overview of MQTT cloud gateways.

Connect a device using MQTT.fx (one-party verification)

Step 1: Create a cloud gateway and device

Create an MQTT cloud gateway. When you configure the gateway, use the content of the server.key file for the Server-side Private Key parameter and the content of the server.crt file for the Server Certificate parameter.

Configure the other parameters as follows: select MQTT for Protocol, keep the default value of 1883 for Custom Port Number, select one-party verification for Authentication Type, select No for Enable Data Parsing, select No for Enable Device X.509 Certificate Authentication, and select Do not enable for Enable OCSP.
In the cloud gateway list, copy and save the Gateway URL.

The cloud gateway list displays information such as the gateway name, protocol, Gateway URL, and status.
Add devices in batches. For this tutorial, add one device. Set MQTT Username to device_01 and MQTT Password to hello123.

Step 2: Configure the MQTT.fx connection

Open the MQTT.fx software. In the menu bar, click Extras and select Edit Connection Profiles.

On the Edit Connection Profiles page, configure the following parameters.

Set the basic information. Use the default values for other parameters.

Parameter	Description
Profile Name	Enter a custom name.
Profile Type	For the connection type, select MQTT Broker.
Broker Address	Enter the domain name from the Gateway URL that you saved.
Broker Port	Set to the custom port number. The default is `1883`.
Client ID	Optional. A custom client ID up to 64 characters long. For easier identification, use the device's MAC address or serial number (SN).

Click User Credentials, select the Use Username/Password checkbox, and set User Name and Password.

The User Name and Password must match the MQTT Username and MQTT Password of the device that you added.
Click SSL/TLS, select the Enable SSL/TLS checkbox, and set Protocol to TLSv1.2.
Select CA certificate file, and then select the path to your root-ca.crt file.

After you configure the parameters, click OK.
Click Connect.

A green light on the right indicates a successful connection. On the IoT Platform console, navigate to the Devices > Devices page for your instance. The status of the device device_01 is online.

Connect a device using MQTT.fx (third-party verification)

Step 1: Create a device authentication function

Log on to the Function Compute console. In the left-side navigation pane, click Services & Functions.
In the top navigation bar, select a region. On the Services page, click Create Service.
In the Create Service panel, enter a service name. Example: IoT_Service. Then, click OK.
On the Functions page, click Create Function.
On the Create Function page, configure the parameters and click Create, as shown in the following figure.

On the Function Details page, replace the sample code with the following code and click Deploy Code.

The authentication function returns the UserName as the deviceName.

# -*- coding: utf-8 -*-
import logging
import json
import time
import enum
import random
import string

class Request:
    def __init__(self, json_str):
        self.clientId = None
        self.username = None
        self.password = None
        self.certificateCommonName = None

        for key, value in json.loads(json_str).items():
            setattr(self, key, value)

class Response:
    def __init__(self):
        self.deviceName = None
        self.result = 'true'
        self.message = 'success'

    def handler(self, request):
        # Verify the validity of the username and password based on your business requirements.
    
        self.deviceName = request.username
        
        
        return json.dumps(self.__dict__)

def handler(event, context):
    request = Request(event)
    return Response().handler(request)

Step 2: Create an MQTT cloud gateway

Create an MQTT cloud gateway. When you configure the gateway, use the content of the server.key file for the Server-side Private Key parameter and the content of the server.crt file for the Server Certificate parameter. For the device authentication Function Compute (FC) service and function, select the IoT_Service and three_part_auth that you created.

Configure the other parameters as follows: set Protocol to MQTT, keep the default Custom Port Number of 1883, set Authentication Type to Third-party Verification, set Enable Data Parsing to No, set Enable Device X.509 Certificate Authentication to No, set Enable OCSP to Disabled, and set Authorization to AliyunIOTAccessingFCRole.
In the cloud gateway list, copy and save the Gateway URL.

The cloud gateway list displays information such as the gateway name, protocol, Gateway URL, and status.

Step 3: Configure the MQTT.fx connection

Open the MQTT.fx software. In the menu bar, click Extras and select Edit Connection Profiles.

On the Edit Connection Profiles page, configure the following parameters.

Set the basic information. Use the default values for other parameters.

Parameter	Description
Profile Name	Enter a custom name.
Profile Type	For the connection type, select MQTT Broker.
Broker Address	Enter the domain name from the Gateway URL that you saved.
Broker Port	Set to the custom port number. The default is `1883`.
Client ID	Optional. A custom client ID up to 64 characters long. For easier identification, use the device's MAC address or serial number (SN).

Click User Credentials, select the Use Username/Password checkbox, and set User Name (for example, threeParty_device_001) and Password.
Note
- User Name: Must be 4 to 32 characters long and can contain letters, digits, hyphens (-), underscores (_), at signs (@), periods (.), and colons (:). The User Name must be unique within the product.
- Password: Must be 1 to 32 characters long and can contain letters, digits, hyphens (-), underscores (_), at signs (@), periods (.), and colons (:).
Click SSL/TLS, select the Enable SSL/TLS checkbox, and set Protocol to TLSv1.2.
Select CA certificate file, and then select the path to your root-ca.crt file.

After you configure the parameters, click OK.
Click Connect.

A green light on the right indicates a successful connection. IoT Platform uses the deviceName returned by the FC authentication function, threeParty_device_001, as the DeviceName for the device. The platform then automatically creates the device, which appears as online on the Devices > Devices page of the IoT Platform console.

Report data using a custom topic

In MQTT.fx, click Publish. In the Publish text box, enter the custom topic: /home/garden/fountain.
In the payload editor, enter the message content and click Publish.
Log on to the IoT Platform console. In your instance, navigate to the Maintenance > Log Service page to view the Device-to-Cloud Messages logs. For more information, see Query cloud-side logs. Click View to open the message details, which show the Topic, timestamp, and payload.