MQTT connection to Azure Event grid broker

This example describes Event Grid Namespace MQTT broker and Aranet PRO base station MQTT configuration details for Client authentication using a self-signed CA certificate chain.

Before configuration, ensure you have access to Event Grid Namespace and it has MQTT broker enabled, alternative client authentication name sources enabled and for client authentication Alternative source fields in client certificate set in following order:

1. Certificate Subject name
2. Certificate DNS

In this example a self-signed CA certificate file, Client certificate file and Client key file are used.

• For CA certificate’s Common Name use MQTT hostname of your Event Grid Namespace.
• For Client certificate’s Common Name use the Aranet base station serial number. It will also be used later in Event Grid Clients configuration as Client Authentication Name.

Generate certificate and key files

OpenSSL utilities are used (example uses OpenSSL v3.0.2). Additional configuration in openssl.cnf is required:

Configuration section	Section variable and value pairs
v3_ca	basicConstraints = critical,CA:TRUE subjectAltName = @alt_names
req	x509_extensions = v3_ca,v3_req req_extensions = v3_req
alt_names	DNS.1 = <Event Grid Namespace MQTT hostname>

Steps to generate the files:

1

1. Generate the CA key:

   • openssl genrsa -aes256 -out ca.key 4096

2

1. Generate the CA certificate file using previously created CA key file (for the Common Name use the MQTT hostname of your available Event Grid Namespace):

   • openssl req -new -x509 -sha256 -days 2525 -key ca.key -out ca.crt - extensions v3_ca

3

1. Verify that the created CA certificate file contains the necessary X509v3 extension key - value pairs: openssl x509 -in ca.crt -text

4

1. Generate client key file:

• openssl genrsa -out client.key 4096

5

1. Generate client certificate signing request file (for the Common Name use the Aranet serial number):

• openssl req -new -sha256 -out client.csr -key client.key -extensions v3_req

6

1. Generate client certificate file using CSR and CA certificate/key files:

• openssl x509 -req -sha256 -in client.csr -CA ca.crt -CAkey ca.key - CAcreateserial -out client.crt -days 2525

Files created:

• ca.crt — root CA certificate used to sign client certificate file (used in Event Grid CA certificate configuration)
• ca.key — CA private key file
• client.crt — client certificate file signed with CA certificate (used in Aranet PRO MQTT configuration)
• client.key — client private key (used in Aranet PRO MQTT configuration)
• client.csr — can be removed (not used)

NOTE: If multiple client key/certificate pairs are needed, the same CA key and certificate files can be used to sign additional client certificates for the same Event Grid Namespace and MQTT hostname.

Proceed with Event Grid configuration steps.

Event Grid configuration – add CA certificate

In Event Grid Namespace → MQTT broker → CA certificates upload ca.crt file. Set name as CertificateCA.

IMPORTANT: Connections from the base station may fail if there are multiple CA certificate files added.

Event Grid configuration – create MQTT broker client

In Event Grid Namespace → MQTT broker → Clients add a new Client.

Set these Authentication Settings:

• Client Authentication Name: <Aranet base station serial number>
• Client Certificate Authentication Validation Scheme: Subject Matches Authentication Name

Set Connection Status to Enabled and press Create to add the new client.

Create root topic for the Event Grid Namespace MQTT broker

In Event Grid Namespace → MQTT broker → Topic spaces create a new Topic space.

• Give a Name for the Topic space (used later in Permission bindings).
• Press Add topic template to add a new topic template.

For the Topic template set the topic: aranetPROBaseStations/#

IMPORTANT: aranetPROBaseStations can be replaced with any other name. Topic template string must end with '/#'.

Create the topic template by pressing Create.

Later in this configuration example manual the topic template aranetPROBaseStations will be used in Aranet PRO MQTT configuration as the Root topic string. NOTE: in the scenario where multiple base stations are connected to the same MQTT broker hostname, the same topic template can be used across all base stations for publishing and subscribing to MQTT messages.

Setup topic Permission bindings for the Event Grid Namespace MQTT broker

In Event Grid Namespace → MQTT broker → Permission bindings create permissions for publishing and subscribing.

• Create permission for the Publisher with appropriate settings and press Create.

• Create permission for the Subscriber with appropriate settings and press Create.

After these steps Event Grid Namespace MQTT broker configuration is complete.

Setup Aranet PRO connection with Event Grid Namespace MQTT broker

Open Aranet PRO web GUI → Integrations: MQTT and use these settings:

• Enable: ON
• Host address: MQTT hostname of your Event Grid Namespace
• Port: 8883
• Protocol version: MQTT v5
• keepAlive: 30 seconds
• Authentication: OFF
• QoS level: 0 or 2 (connection is dropped using QoS 1)
• Root topic: aranetPROBaseStations
• Sensor measurement format: raw or JSON
• Encryption: TLSv1.2
• Validate host certificate: OFF
• Supply client certificate: ON

  • Client private key: upload client.key file
  • Client certificate: upload client.crt file

Press the save icon. If configuration is correct Aranet PRO MQTT client will report "Connection successful".

Now messages from the Aranet PRO base station MQTT client are being published to the Event Grid Namespace MQTT broker.