Connecting a KMP project to AWS IoT Core (Illegal base64 character 2d)

[prestondavid99]

Hi!

I've been at this grind for about 6 months now with not much success unfortunately.

All I want to do is send a message to the AWS IoT core "MQTT test client". Nothing has worked yet.

I've created a test file to run these tests. I will now explain in meticulous detail every single thing I've done and hopefully a good soul out there can fill in the blanks! 🙏

1. Access IoT Service https://us-east-1.console.aws.amazon.com/iot/home?region=us-east-1#/home
2. Sign in using root user
3. In the left menu, select All Devices->Things

4. Select Create Things 5. Create single thing 6. Set thing name as "esp32". Leave all other settings default including No Device Shadow 7. Auto generate a new certificate 8. Create a new policy (this opens a new tab) 9. Title Policy "esp32_policy" and select "Add New Statement" from the bottom section 4 times for a total of 4 statements 10. Here are the 4 policy actions I have selected 11. For the next 4 steps, this is the documentation page that I will be referencing:

https://docs.aws.amazon.com/iot/latest/developerguide/iot-action-resources.html

The documentation gives this format for action resources

• The partition is aws
• The region I am using is us-east-1
  Your region will be listed in the URL. If you are still on the "Create Policy" page it will look like this:
  https://us-east-1.console.aws.amazon.com/iot/home?region=us-east-1#/create/policy

Otherwise it's also found by clicking on your region in the top right corner:

You can easily find your account ID by clicking on your username in the top right corner

Be sure to use YOUR account ID. My AWS-account-ID I have replaced with X's

12. Set the iot:Connect policy resource. Mine ended up being: arn:aws:iot:us-east-1:XXXXXXXXXXXX:client/${iot:Connection.Thing.ThingName}

• The resource type is client
• The resource name is your client's clientId. For the clientId, I will use a policy variable: ${iot:Connection.Thing.ThingName}. This variable will be replaced by "esp32" since that is the name I chose for the thing name.

13. Set the iot:Publish policy resource. Mine was arn:aws:iot:us-east-1:XXXXXXXXXXXX:topic/home

• The resource type is topic
• The resource name is a topic string. I have chosen home

14. Set the iot:Recieve policy resource. Mine was arn:aws:iot:us-east-1:XXXXXXXXXXXX:topic/home

• The resource type is topic
• The resource name is a topic string. I have chosen home once again.

15. Set the iot:Subscribe policy resource. Mine was arn:aws:iot:us-east-1:XXXXXXXXXXXX:topicfilter/home

• The resource type is topicfilter
• The resource name is a topic filter string. I chose home again.

16. At this point you should have everything filled out. Press Create
    

17. Go back to the tab where you can attach the policy you've now created. It should appear as "esp32_policy". Refresh the page if you can't see it. Select it, then click on "Create thing".
    

18. You will be prompted to download the necessary certificates/keys. I downloaded the device certificate, the public key (though I won't need it), the private key, and the Amazon Root CA 1 certificate. Then hit "Done"
    

IMPORTANT NOTE: I renamed my files to
device_cert.pem.crt
public_key.pem.key
private_key.pem.key
I didn't have to change AmazonRootCA1.pem

PART 2: KMP
19. I used the KMP wizard, named the project HelloMQTT, selected Android and iOS (with shared UI), then clicked download. After downloading, I unzipped the file.

20. Opening Android Studio, select Open. Choose the file that you unzipped.

21. Change the view from Android to Project

22. Navigate to composeApp->build.gradle.kts

23. In the build.gradle.kts, add the dependencies required by KMP. Also add the commonTest source set as well as the dependency.

implementation("io.github.davidepianca98:kmqtt-common:1.0.0")
implementation("io.github.davidepianca98:kmqtt-client:1.0.0")

commonTest.dependencies {
            implementation(libs.kotlin.test)
        }

Here is what your file should roughly end up looking like:

24. Sync the changes.

25. Right click on composeApp and select New->Directory

26. Start typing in "common". You should see commonTest/kotlin appear. Select that.

27. Right click on the newly created directory and create a file called MqttTest

28. Paste this code into MqttTest:
    `import io.github.davidepianca98.MQTTClient
    import io.github.davidepianca98.mqtt.MQTTVersion
    import io.github.davidepianca98.mqtt.Subscription
    import io.github.davidepianca98.mqtt.packets.Qos
    import io.github.davidepianca98.mqtt.packets.mqttv5.SubscriptionOptions
    import io.github.davidepianca98.socket.tls.TLSClientSettings
    import kotlin.test.Test

class MqttTest {
companion object {
private const val serverCertificate = "../AmazonRootCA1.pem"
private const val privateKey = "../private_key.pem.key"
private const val deviceCertificate = "../device_cert.pem.crt"
}

@Test
fun mqttTest() {
    val client = MQTTClient(
        MQTTVersion.MQTT5,            // Using MQTT v5 protocol
        "a12offtehlmcn0-ats.iot.us-east-1.amazonaws.com",         // Test broker
        8883,
        TLSClientSettings(
            serverCertificate = serverCertificate,
            clientCertificate = deviceCertificate,
            clientCertificateKey = privateKey
        ),
        clientId = "esp32",
        keepAlive = 30,
        debugLog = true,              // Enable debug logging
    ) {
        println(it.payload?.toByteArray()?.decodeToString())
    }
    client.subscribe(listOf(Subscription("/home", SubscriptionOptions(Qos.AT_LEAST_ONCE))))
    client.publish(false, Qos.AT_LEAST_ONCE, "/home", "hello".encodeToByteArray().toUByteArray())
    client.run() // Blocking method, use step() if you don't want to block the thread
}

}`

29. Move the files downloaded from Amazon into the root folder of the application.

30. Here are my assumptions. Please correct me if I'm wrong.
    The TLSClientSettings should be configured as follows

• serverCertificate is AmazonRootCA1.pem
• clientCertificate is device_cert.pem.crt
• clientCertificateKey is private_key.pem.key

The address is a12offtehlmcn0-ats.iot.us-east-1.amazonaws.com which can be found on AWS IoT Core by clicking on the Mqtt Test Client and viewing the connection details.

The clientId should the be name of my thing (esp32) since that is what I set up in the policy steps.

So with all of this said, when I run the code I get the error: java.lang.IllegalArgumentException: Illegal base64 character 2d
I tried following the advice of AI by running these commands in my terminal (at the root of my project):
openssl x509 -in device_cert.pem.crt -outform PEM -out device_cert.pem.crt
and
openssl rsa -in private_key.pem.key -outform PEM -out private_key.pem.key

But no change. I still get the same error. Perhaps there's something I'm doing wrong on the AWS side? Maybe the KMP side? I'm really quite lost and would appreciate any help I can get!

[prestondavid99]

I got it working! I was successful at sending and receiving a message from AWS IoT Core.

Here is the code:

import io.github.davidepianca98.MQTTClient
import io.github.davidepianca98.mqtt.MQTTVersion
import io.github.davidepianca98.mqtt.Subscription
import io.github.davidepianca98.mqtt.packets.Qos
import io.github.davidepianca98.mqtt.packets.mqttv5.SubscriptionOptions
import io.github.davidepianca98.socket.tls.TLSClientSettings
import kotlin.test.Test

class MqttAWSTest {
    companion object {
        private const val serverCertificate = "../AmazonRootCA1.pem"
        private const val privateKey = "../private_key.pem.key"
        private const val deviceCertificate = "../device_cert.pem.crt"
    }


    @Test
    fun mqttTest() {
        val client = MQTTClient(
            MQTTVersion.MQTT5,            // Using MQTT v5 protocol
            "a12offtehlmcn0-ats.iot.us-east-1.amazonaws.com",         // Test broker
            8883,
            TLSClientSettings(
                serverCertificate = serverCertificate,
                clientCertificate = deviceCertificate,
                clientCertificateKey = privateKey
            ),
            keepAlive = 30,
            debugLog = true,              // Enable debug logging
        ) {
            println(it.payload?.toByteArray()?.decodeToString())
        }

        try {
            client.subscribe(listOf(Subscription("/home", SubscriptionOptions(Qos.AT_LEAST_ONCE))))
            client.publish(false, Qos.AT_LEAST_ONCE, "/home", "yes".encodeToByteArray().toUByteArray())
            client.run() // Blocking method, use step() if you don't want to block the thread
        } catch (e: Exception) {
            println("Error: ${e.message}")
            e.printStackTrace()
        }
    }
}

Turns out, there was a problem with my policy settings. Here are the adjusted, super unsecure settings:

I was getting the Illegal base64 character 2d error, but working on it the next day, that error went away. Maybe I just needed to wait a day?

I'm going to slowly try and bring security back into the policies and run things one step at a time.