IoT Security Basics: TLS for MQTT, Device Credentials and Safe Updates

#include <WiFi.h>
#include <WiFiClientSecure.h>
#include <PubSubClient.h>
#include <time.h>
#include "secrets.h"   // WIFI_SSID, WIFI_PASS, MQTT_USER, MQTT_PASS

const char* MQTT_HOST = "192.168.1.50";   // must appear in the cert SAN

// Contents of ca.crt (public, not secret)
const char* CA_CERT = R"EOF(
-----BEGIN CERTIFICATE-----
...paste your ca.crt here...
-----END CERTIFICATE-----
)EOF";

WiFiClientSecure tlsClient;
PubSubClient mqtt(tlsClient);

void syncTime() {
  // Correct time lets the device check certificate expiry dates
  configTime(19800, 0, "pool.ntp.org");    // IST = UTC + 5:30 = 19800 s
  struct tm now;
  getLocalTime(&now, 10000);               // wait up to 10 s
}

void setup() {
  Serial.begin(115200);
  WiFi.begin(WIFI_SSID, WIFI_PASS);
  while (WiFi.status() != WL_CONNECTED) delay(500);
  syncTime();

  tlsClient.setCACert(CA_CERT);            // reject any other server
  mqtt.setServer(MQTT_HOST, 8883);

  if (mqtt.connect("node1", MQTT_USER, MQTT_PASS)) {
    mqtt.publish("home/node1/status", "online (TLS)", true);
    Serial.println("Secure MQTT connected");
  } else {
    char err[100];
    tlsClient.lastError(err, sizeof(err)); // TLS-level reason
    Serial.printf("Failed, state %d, TLS: %s", mqtt.state(), err);
    Serial.println();
  }
}

void loop() {
  mqtt.loop();
}