I recently set up ChirpStack, and I’ve noticed that MQTT messages are published without encryption by default, making them vulnerable to eavesdropping and potential hacking. Are there any easy and quick ways to secure MQTT communication? Are there specific tools or configurations that you would recommend for encrypting MQTT messages to enhance security? Any advice on best practices for securing ChirpStack’s MQTT messages would be greatly appreciated!
What is your configuration that you see this happening?
General best practices are to put TLS in front of MQTT (usually run on port 8883), and to use either strong username/passwords or certificates to authenticate a gateway. Those should cover all your concerns.
Edit: Applying ACLs based on your organization and needs may also be a good idea.
1 Like
I can do encryption with mosquitto but then I have problems with chirpstack, is there a page or an example that shows a way for mqtt encryption and chirpstack application?
Do you really think I haven’t analysed this connection?
If I had, I would have asked about the certificate, wouldn’t I? My question is how do I implement the mosquitto app in chirpstack after logging in with a password?
Buddy relax. Just trying to help.
You’d be surprised what people haven’t read before posting.
Besides your question doesn’t even make sense:
By mosquitto app do you mean an integration? Or simply having your gateways + chirpstack connect to the MQTT broker using username/pass?
After logging in where with a password? The Chirpstack UI? Or do you mean after configuring MQTT to require a password?
When I set a password on Mosquitto, ChirpStack fails to connect, and the system crashes. I just want to enable secure access to Mosquitto with a username and password, without adding certificates. My goal is for ChirpStack to connect to the MQTT broker using the username and password as well.
Could you please guide me on how to achieve this or suggest the steps I should follow?
Once you have configured a password file to be associated with your MQTT listener, all you need to do is configure Chirpstack and your GW Bridge / MQTT broker to use those credentials.
If you look at the example configuration options: Configuration - ChirpStack open-source LoRaWAN® Network Server documentation
In the regional.toml files (eu868 example) is where you find Chirpstack’s MQTT backend configuration (the integration.mqtt section in chirpstack.toml is an integration not a backend) You’re looking for the following section:
[regions.gateway.backend.mqtt]
# Event topic template.
event_topic="eu868/gateway/+/event/+"
# Command topic template.
command_topic="eu868/gateway/{{ gateway_id }}/command/{{ command }}"
# MQTT server (e.g. scheme://host:port where scheme is tcp, ssl or ws)
server="tcp://localhost:1883"
# Connect with the given username (optional)
username=""
# Connect with the given password (optional)
password=""
Then in your chirpstack-gateway-bridge.toml you’re looking for the following section:
[integration.mqtt.auth.generic]
# MQTT servers.
#
# Configure one or multiple MQTT server to connect to. Each item must be in
# the following format: scheme://host:port where scheme is tcp, ssl or ws.
servers=[
"tcp://127.0.0.1:1883",
]
# Connect with the given username (optional)
username=""
# Connect with the given password (optional)
password=""
But to be clear this is not encryption it’s authentication. If you want a fully secured broker you will have to look into the certificates, self-signed or autogenerated by something like cert-bot.
If you only configure the broker to use a user/pass without using TLS encryption an eavesdropper could simply get the MQTT user/pass from your traffic and then connect themselves.
1 Like
You can also use an encrypted connection without client certificates. The MQTT login credentials are then used.
However, the server certificate must be created and used as a minimum - > ca_cert=…
ChirpStack config
server="ssl://loraserver.***.de:8883"
# Connect with the given username (optional)
username="chirpstack"
# Connect with the given password (optional)
password="xxxxx"
# CA certificate file (not optional when using TLS!)
#
# Use this when setting up a secure connection (when server uses ssl://...)
# but the certificate used by the server is not trusted by any CA certificate
# on the server (e.g. when self generated).
ca_cert="/path_to/ca.crt"
# mqtt TLS certificate file (optional: if not declared, the above authentication is used)
# tls_cert="/path_to/client.crt"
# mqtt TLS key file (optional: if not declared, the above authentication is used)
# tls_key="/path_to/client-nopw.key"
This has been working for me for quite a while.
2 Likes
Use EMQX MQTT broker
Thank you so much Philipp,
i am not familliar with certification, kindly can you record screen for how to easiest way to create and apply to server?
i installed with Docker btw 
Thanks alot
The guide I shared previously is the easiest way to create self-signed certs and apply them to Chirpstack.
If you’re willing to put in a bit more time into your setup to avoid needing to worry about certificate expiry and other headaches I would recommend Traefik. A reverse-proxy which can handle automatically generating certificates from LetsEncrypt to handle TLS and then proxy the traffic to your Chirpstack services.
If you are interested I can share my Traefik configuration.
1 Like
Seconded, this is my approach. It’s a lot more straight-forward than becoming your own CA.
1 Like