title: Connect to AWS MQTT broker using openssl intermediate certificate
body: <p>I have some problem with this project <a href="https://github.com/debsahu/ESP-MQTT-AWS-IoT-Core" rel="nofollow noreferrer">https://github.com/debsahu/ESP-MQTT-AWS-IoT-Core</a>: if I use the AWS certificates everything works good, but if I use certificates created with openssl, the code return this error: "failed, reason -> Connection Accepted &lt; try again in 5 seconds"</p>
  
  <p>To create the intermediate certificate (best practise for aws) i used this guide: <a href="https://jamielinux.com/docs/openssl-certificate-authority/introduction.html" rel="nofollow noreferrer">https://jamielinux.com/docs/openssl-certificate-authority/introduction.html</a></p>
  
  <pre><code>#ifdef ESP32
  #include &lt;WiFi.h&gt;
  #elif defined(ESP8266)
  #include &lt;ESP8266WiFi.h&gt;
  #else
  #error Platform not supported
  #endif
  #include &lt;WiFiClientSecure.h&gt;
  #include &lt;ArduinoJson.h&gt; //https://github.com/bblanchon/ArduinoJson (use v6.xx)
  #include &lt;time.h&gt;
  #define emptyString String()
  
  //Follow instructions from https://github.com/debsahu/ESP-MQTT-AWS-IoT-        Core/blob/master/doc/README.md
  //Enter values in secrets.h ▼
  #include "secrets.h"
  
  #ifndef PIO_PLATFORM
  //#define USE_PUB_SUB  //uncomment to use PubSubClient(https://github.com/knolleary/pubsubclient)
  #endif
  
  #if !(ARDUINOJSON_VERSION_MAJOR == 6 and ARDUINOJSON_VERSION_MINOR &gt;= 7)
  #error "Install ArduinoJson v6.7.0-beta or higher"
  #endif
  
  const int MQTT_PORT = 8883;
  const char MQTT_SUB_TOPIC[] = "$aws/things/OggettoZero/shadow/update";
  const char MQTT_PUB_TOPIC[] = "$aws/things/OggettoZero/shadow/update";
  
  #ifdef USE_SUMMER_TIME_DST
  uint8_t DST = 1;
  #else
  uint8_t DST = 0;
  #endif
  
  WiFiClientSecure net;
  
  #ifdef ESP8266
  BearSSL::X509List cert(cacert);
  BearSSL::X509List client_crt(client_cert);
  BearSSL::PrivateKey key(privkey);
  #endif
  
  #ifdef USE_PUB_SUB
  #include &lt;PubSubClient.h&gt;
  #if defined(USE_PUB_SUB) and defined(PIO_PLATFORM) // PIO has issues, needs MQTT.h definition or else freaks out
  #include &lt;MQTT.h&gt;
  #endif
  PubSubClient client(net);
  #else
  #include &lt;MQTT.h&gt;
  MQTTClient client;
  #endif
  
  unsigned long lastMillis = 0;
  time_t now;
  time_t nowish = 1510592825;
  
  void NTPConnect(void)
  {
    Serial.print("Setting time using SNTP");
    configTime(TIME_ZONE * 3600, DST * 3600, "pool.ntp.org", "time.nist.gov");
    now = time(nullptr);
    while (now &lt; nowish)
    {
      delay(500);
      Serial.print(".");
      now = time(nullptr);
    }
    Serial.println("done!");
    struct tm timeinfo;
    gmtime_r(&amp;now, &amp;timeinfo);
    Serial.print("Current time: ");
    Serial.print(asctime(&amp;timeinfo));
  }
  
  #ifdef USE_PUB_SUB
  
  void messageReceivedPubSub(char *topic, byte *payload, unsigned int length)
  {
    Serial.print("Received [");
    Serial.print(topic);
    Serial.print("]: ");
    for (unsigned int i = 0; i &lt; length; i++)
    {
      Serial.print((char)payload[i]);
    }
    Serial.println();
  }
  
  void pubSubErr(int8_t MQTTErr)
  {
    if (MQTTErr == MQTT_CONNECTION_TIMEOUT)
      Serial.print("Connection tiemout");
    else if (MQTTErr == MQTT_CONNECTION_LOST)
      Serial.print("Connection lost");
    else if (MQTTErr == MQTT_CONNECT_FAILED)
      Serial.print("Connect failed");
    else if (MQTTErr == MQTT_DISCONNECTED)
      Serial.print("Disconnected");
    else if (MQTTErr == MQTT_CONNECTED)
      Serial.print("Connected");
    else if (MQTTErr == MQTT_CONNECT_BAD_PROTOCOL)
      Serial.print("Connect bad protocol");
    else if (MQTTErr == MQTT_CONNECT_BAD_CLIENT_ID)
      Serial.print("Connect bad Client-ID");
    else if (MQTTErr == MQTT_CONNECT_UNAVAILABLE)
      Serial.print("Connect unavailable");
    else if (MQTTErr == MQTT_CONNECT_BAD_CREDENTIALS)
      Serial.print("Connect bad credentials");
    else if (MQTTErr == MQTT_CONNECT_UNAUTHORIZED)
      Serial.print("Connect unauthorized");
  }
  
  #else
  
  void messageReceived(String &amp;topic, String &amp;payload)
  {
    Serial.println("Recieved [" + topic + "]: " + payload);
  }
  
  void lwMQTTErr(lwmqtt_err_t reason)
  {
    if (reason == lwmqtt_err_t::LWMQTT_SUCCESS)
      Serial.print("Success");
    else if (reason == lwmqtt_err_t::LWMQTT_BUFFER_TOO_SHORT)
      Serial.print("Buffer too short");
    else if (reason == lwmqtt_err_t::LWMQTT_VARNUM_OVERFLOW)
      Serial.print("Varnum overflow");
    else if (reason == lwmqtt_err_t::LWMQTT_NETWORK_FAILED_CONNECT)
      Serial.print("Network failed connect");
    else if (reason == lwmqtt_err_t::LWMQTT_NETWORK_TIMEOUT)
      Serial.print("Network timeout");
    else if (reason == lwmqtt_err_t::LWMQTT_NETWORK_FAILED_READ)
      Serial.print("Network failed read");
    else if (reason == lwmqtt_err_t::LWMQTT_NETWORK_FAILED_WRITE)
      Serial.print("Network failed write");
    else if (reason == lwmqtt_err_t::LWMQTT_REMAINING_LENGTH_OVERFLOW)
      Serial.print("Remaining length overflow");
    else if (reason == lwmqtt_err_t::LWMQTT_REMAINING_LENGTH_MISMATCH)
      Serial.print("Remaining length mismatch");
    else if (reason == lwmqtt_err_t::LWMQTT_MISSING_OR_WRONG_PACKET)
      Serial.print("Missing or wrong packet");
    else if (reason == lwmqtt_err_t::LWMQTT_CONNECTION_DENIED)
      Serial.print("Connection denied");
    else if (reason == lwmqtt_err_t::LWMQTT_FAILED_SUBSCRIPTION)
      Serial.print("Failed subscription");
    else if (reason == lwmqtt_err_t::LWMQTT_SUBACK_ARRAY_OVERFLOW)
      Serial.print("Suback array overflow");
    else if (reason == lwmqtt_err_t::LWMQTT_PONG_TIMEOUT)
      Serial.print("Pong timeout");
  }
  
  void lwMQTTErrConnection(lwmqtt_return_code_t reason)
  {
    if (reason == lwmqtt_return_code_t::LWMQTT_CONNECTION_ACCEPTED)
      Serial.print("Connection Accepted");
    else if (reason == lwmqtt_return_code_t::LWMQTT_UNACCEPTABLE_PROTOCOL)
      Serial.print("Unacceptable Protocol");
    else if (reason == lwmqtt_return_code_t::LWMQTT_IDENTIFIER_REJECTED)
      Serial.print("Identifier Rejected");
    else if (reason == lwmqtt_return_code_t::LWMQTT_SERVER_UNAVAILABLE)
      Serial.print("Server Unavailable");
    else if (reason == lwmqtt_return_code_t::LWMQTT_BAD_USERNAME_OR_PASSWORD)
      Serial.print("Bad UserName/Password");
    else if (reason == lwmqtt_return_code_t::LWMQTT_NOT_AUTHORIZED)
      Serial.print("Not Authorized");
    else if (reason == lwmqtt_return_code_t::LWMQTT_UNKNOWN_RETURN_CODE)
      Serial.print("Unknown Return Code");
  }
  #endif
  
  void connectToMqtt(bool nonBlocking = false)
  {
    Serial.print("MQTT connecting ");
    while (!client.connected())
    {
      if (client.connect(THINGNAME))
      {
        Serial.println("connected!");
        if (!client.subscribe(MQTT_SUB_TOPIC))
  #ifdef USE_PUB_SUB
          pubSubErr(client.state());
  #else
          lwMQTTErr(client.lastError());
  #endif
      }
      else
      {
        Serial.print("failed, reason -&gt; ");
  #ifdef USE_PUB_SUB
        pubSubErr(client.state());
  #else
        lwMQTTErrConnection(client.returnCode());
  #endif
        if (!nonBlocking)
        {
          Serial.println(" &lt; try again in 5 seconds");
          delay(5000);
        }
        else
        {
          Serial.println(" &lt;");
        }
      }
      if (nonBlocking)
        break;
    }
  }
  
  void connectToWiFi(String init_str)
  {
    if (init_str != emptyString)
      Serial.print(init_str);
    while (WiFi.status() != WL_CONNECTED)
    {
      Serial.print(".");
      delay(1000);
    }
    if (init_str != emptyString)
      Serial.println("ok!");
  }
  
  void checkWiFiThenMQTT(void)
  {
    connectToWiFi("Checking WiFi");
    connectToMqtt();
  }
  
  unsigned long previousMillis = 0;
  const long interval = 5000;
  
  void checkWiFiThenMQTTNonBlocking(void)
  {
    connectToWiFi(emptyString);
    if (millis() - previousMillis &gt;= interval &amp;&amp; !client.connected()) {
      previousMillis = millis();
      connectToMqtt(true);
    }
  }
  
  void checkWiFiThenReboot(void)
  {
    connectToWiFi("Checking WiFi");
    Serial.print("Rebooting");
    ESP.restart();
  }
  
  void sendData(void)
  {
    DynamicJsonDocument jsonBuffer(JSON_OBJECT_SIZE(3) + 100);
    JsonObject root = jsonBuffer.to&lt;JsonObject&gt;();
    JsonObject state = root.createNestedObject("state");
    JsonObject state_reported = state.createNestedObject("reported");
    state_reported["value"] = random(100);
    Serial.printf("Sending  [%s]: ", MQTT_PUB_TOPIC);
    serializeJson(root, Serial);
    Serial.println();
    char shadow[measureJson(root) + 1];
    serializeJson(root, shadow, sizeof(shadow));
  #ifdef USE_PUB_SUB
    if (!client.publish(MQTT_PUB_TOPIC, shadow, false))
      pubSubErr(client.state());
  #else
    if (!client.publish(MQTT_PUB_TOPIC, shadow, false, 0))
      lwMQTTErr(client.lastError());
  #endif
  }
  
  void setup()
  {
    Serial.begin(115200);
    delay(5000);
    Serial.println();
    Serial.println();
  #ifdef ESP32
    WiFi.setHostname(THINGNAME);
  #else
    WiFi.hostname(THINGNAME);
  #endif
    WiFi.mode(WIFI_STA);
    WiFi.begin(ssid, pass);
    connectToWiFi(String("Attempting to connect to SSID: ") + String(ssid));
  
    NTPConnect();
  
  #ifdef ESP32
    net.setCACert(cacert);
    net.setCertificate(client_cert);
    net.setPrivateKey(privkey);
  #else
    net.setTrustAnchors(&amp;cert);
    net.setClientRSACert(&amp;client_crt, &amp;key);
  #endif
  
  #ifdef USE_PUB_SUB
    client.setServer(MQTT_HOST, MQTT_PORT);
    client.setCallback(messageReceivedPubSub);
  #else
    client.begin(MQTT_HOST, MQTT_PORT, net);
    client.onMessage(messageReceived);
  #endif
    connectToMqtt();
  }
  
  void loop()
  {
    now = time(nullptr);
    if (!client.connected())
    {
      checkWiFiThenMQTT();
      //checkWiFiThenMQTTNonBlocking();
      //checkWiFiThenReboot();
    }
    else
    {
      client.loop();
      if (millis() - lastMillis &gt; 5000)
      {
        lastMillis = millis();
        sendData();
      }
    }
  }
  </code></pre>
  
  <p>In file secret.h I put the certificates created with openssl: private  key, device certificate and CA certificate.</p>
  
  <p>I expected that the connection will work exactly like with the AWS certificates, but the code return me this error: "failed, reason -> Connection Accepted &lt; try again in 5 seconds" and I don't what kind of error it can be!</p>