How to generate trusted SSL certificate for secure MQTT?

Question

I am a beginner with information security and everything about SSL just goes over my head.

Currently I'm trying to get an IoT device(ESP32) to connect to an MQTT broker, broker.losant.com:8883 in my case, over TLS. The device has been flashed with Mongoose OS which relies on mbedTLS library to secure MQTT.

The issue which I face is that mbedTL says that "The certificate is not correctly signed by the trusted CA" when I use a self signed certificate. Where can I get this trusted certificate or how am I supposed to generate it? I've been digging the internet for quite some time now but sadly, nothing is present in the Mongoose-OS docs.

Please tell me the steps I need to follow to get my secure MQTT connection up and running.

Answer 1

If you initiate a TLS connection, the server will send you a certificate to proof its identity. This is needed to acquire an authenticated connection.

This certificates must be issued for the domain name that you are connecting to. The certificate is signed by a trusted certificate authority (CA) in oreder for you to verify the claim (otherwise, everyone could issue a certificate for your domain). The fact that the used CA is trusted has to be known to the application. Standard OSs and browsers ship with an integrated trust store so the user never notices that.

In the case of an embedded application, you will have to include the CA certificate used by your server manually.

The server will you send you its certificates during the handshake. It might also send you the whole certificate chain, including the CA certificate(s). If this is not the case, the server certificate will probably contain an URL where it can be downloaded from.