Root certificates work for port 443, but not for port 8883 (MQTTS) about arduinobearssl

[aentinger]

Not sure, but possibly an issue with SNI? Try using the setInsecure API to see if it solves your problem, then fix the underlying SNI issue.

[manchoz]

Hi @ffontaine, you need to create your own TAs starting from the mosquitto.org certificate using the brssl tool and use the extended begin constructor to initialize the BearSSL object. Take a look at [ArduinoBearSSL - adding root certificates](https://forum.arduino.cc/t/arduinobearssl-adding-root-certificates/610184/2).

[manchoz]

For future reference:

The full command is something like:

brssl ta my_tas_and_certs.pem > MyTAs.h

Then, add MyTAs.h file to the sketch folder/project and use the TAs array in the constructor of the BearSSLClient object:

#include "MyTAs.h"

WiFiClient client;
BearSSLClient sslClient(client, TAs, TAs_NUM);

[cbpure]

Same experience. I used ESP32S3 and SIM7670G and Azure iot hub. Bearssl works fine with port 443 towards to vsh.pp.ua:443 but when I tried to azure dps mqtts server with 8883 port, it does not work. returning -2 error(server connection error). It should work because Azure server is using Digicert Root G2 so there shouldn't be an issue. Therefore, I tried different SSL support from TinyGSM with SIMCOM A767X and it also has Digicert Root G2 and it works perfect. It seems ArduinoBearSSL mqtts support is not working over GSM client