MQTT broker configuration to support multiple TLS connections

[mark-127]

Hello.

I'm a bit new to MQTTnet. We have a use case where we need to support multiple devices, each having a unique endpoint. Each device will communicate using the same IP address but on different ports. We need to support connections to each device over TLS, and we must also support default connection (non-TLS). Also, we only support one connection at a time. Our requirements are basically as follows. These aren’t the actual values but just added for the example.

Device A: 127.0.0.1:50005 (TLS 1.2 / TLS 1.3)
Device B: 127.0.0.1:50006 (TLS 1.2 / TLS 1.3)
Default endpoint: 127.0.0.1:50003

We would like to do this using a single Server / Broker, something like the following. However, this doesn’t seem to work. The broker starts successfully, but when trying to connect the client, only the device 2 client connection is successful. It seems to make some sense that this wouldn’t work, because device 2 endpoint options aren’t appending, but instead overwriting device 1.

       var defaultEndpointOptions = new MqttServerOptionsBuilder()
            // Default connection required
            .WithDefaultEndpoint()
            .WithDefaultEndpointPort(50003)
            .WithDefaultEndpointBoundIPAddress(IPAddress.Parse("127.0.0.1"))
            // TLS connection for device 1
            .WithEncryptedEndpoint()
            .WithEncryptedEndpointPort(50005)
            .WithEncryptedEndpointBoundIPAddress(IPAddress.Parse("127.0.0.1"))
            .WithEncryptionCertificate(new X509Certificate2(device1BrokerCertificate, password, X509KeyStorageFlags.Exportable).Export(X509ContentType.Pfx))
            .WithClientCertificate(CertificateValidationCallback1, false)
            // TLS connection for device 2
            .WithEncryptedEndpoint()
            .WithEncryptedEndpointPort(50006)
            .WithEncryptedEndpointBoundIPAddress(IPAddress.Parse("127.0.0.1"))
            .WithEncryptionCertificate(new X509Certificate2(device2BrokerCertificate, password, X509KeyStorageFlags.Exportable).Export(X509ContentType.Pfx))
            .WithClientCertificate(CertificateValidationCallback2, false)
            .WithDefaultCommunicationTimeout(new TimeSpan(0, 0, 5))
            .WithConnectionBacklog(100)     // Number of client max possible
            .Build();

Ideally, we would like to create / start our server broker once (e.g. app start or when user clicks connect) so that when changing from device 1 to device 2, or vice-versa, we won’t have to stop the broker, reconfigure it to use the endpoint options associated with the new selected device and then restart it.

Is this possible?

Thanks!

[chkr1011]

Multiple endpoints are not yet supported. Only one default (without TLS) and one encrypted endpoint can be used. But there are already branches which add support for a feature called "Endpoints" which are basically a list of endpoints like TCP, WebSocket etc. which can have different settings. But I cannot tell when this is ready to be released.

[mark-127]

Hi. Thank you very much for the response!