# Using TLS-PSK with MQTT

**URL:** <https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872>\
**Category:** General\
**Tags:** mqtt\
**Created:** [15 March 2022 08:28 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872 "2022-03-15T08:28:25Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![dktcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dktcl/32/49261_2.png) [@dktcl](https://discourse.nodered.org/u/dktcl)\
**Post date:** [15 March 2022 08:28 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/1 "2022-03-15T08:28:26Z")

</div>

Good Morning,

I need to communicate with a 3rd party MQTT Broker using TLS-PSK, however I'm struggling to figure out if and how to achieve with Node-Red.

If I were using mosquito sub, I would use the command line options `--psk hex-key --psk-identity identity-string`.

In the TLS config panel of MQTT, I don't see any options for PSK.

Note that I have no issue connecting to any other MQTT brokers via port 1883 or 8883, using username & passwords.

Thanks in advance to your help. Any congratulations to the community for a great software tool - I've enjoyed using it for the last 5 years!

Cheers,

Dave

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [15 March 2022 12:22 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/2 "2022-03-15T12:22:07Z")

</div>

Interesting. I'm not sure that the mqtt nodes allow that setting right now. @Steve-Mcl - do you know about that?

---

<div class="post-metadata">

**Author:** ![krambriw](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/krambriw/32/5429_2.png) [@krambriw](https://discourse.nodered.org/u/krambriw)\
**Post date:** [15 March 2022 12:46 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/3 "2022-03-15T12:46:18Z")

</div>

Would maybe be a good option - alternative to use cerificates?? Is it as secure?

> **[Basic understanding of TLS-PSK protocol](https://mingdos.blogspot.com/2019/12/basic-understanding-of-tls-psk-protocol.html)**
>
> This post will talk about the basic understanding of TLS-PSK protocol. It will not cover TLS's history and how its mathematical algorithms ...

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [15 March 2022 13:14 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/4 "2022-03-15T13:14:15Z")

</div>

The only mention of PSK in `mqtt.js` is here: [Anthentication PSK (pre shared key) with Mosquitto · Issue #283 · mqttjs/MQTT.js · GitHub](https://github.com/mqttjs/MQTT.js/issues/283) - not much to go on.

However, I do know mosquitto supports psk and nodejs supports psk

Will need some time to setup a broker & investigate try using psk with mqtt.js on tls.

I would suggest the OP raises this in the #development:feature-requests

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [15 March 2022 13:18 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/5 "2022-03-15T13:18:11Z")

</div>

I don't believe that PSK is as secure as certificate base auth. However, depending on the use-case, it might not be significant. The problem with PSK is that, if the key is compromised, you have to reset it for everyone. With certificate based mutual-authentication, you might not need to do that and even if you do, there are automated mechanisms that mean that the client might not even notice.

More importantly though as the question is about an external service, I doubt that the OP could get the authentication method changed.

> [@Steve-Mcl](#):
>
> Will need some time to setup a broker & investigate try using psk with mqtt.js on tls.

Apologies for pinging you direct on this one Steve but I thought you might know or would be able to investigate 🙂 Probably would be quite nice to have PSK as an option.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [15 March 2022 13:23 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/6 "2022-03-15T13:23:22Z")

</div>

> [@TotallyInformation](#):
>
> The problem with PSK is that, if the key is compromised, you have to reset it for everyone

True however (for example) in mosquitto, you can specify multiple `identity:psk` in the `psk_file`

---

<div class="post-metadata">

**Author:** ![dktcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dktcl/32/49261_2.png) [@dktcl](https://discourse.nodered.org/u/dktcl)\
**Post date:** [15 March 2022 13:31 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/7 "2022-03-15T13:31:13Z")

</div>

Hi All. Thanks for your replies.

As @TotallyInformation guessed, I cannot insist that the authentication method is changed.

I agree with @krambriw and @TotallyInformation that certificate based authentication is safer. however, in this use case, there are a limited number of gateways communicating with a broker to co-ordinate a green energy trial. The disadvantages @TotallyInformation discussed would have a limited impact.

I would be grateful for any quick fixes - even if I need to write some custom js code. My backup plan is to call mosquitto\_sub CLI, passing in payload and extracting payloads. That would obviously be a bit of a PITA.

And yes, happy to raise a feature request.

Thanks again all!

---

<div class="post-metadata">

**Author:** ![Olito](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/olito/32/65473_2.png) [@Olito](https://discourse.nodered.org/u/Olito)\
**Post date:** [21 April 2022 07:32 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/8 "2022-04-21T07:32:33Z")

</div>

Anybody knows what are the necessarry parameters for a simple mosquitto.conf setup in order to work with TSL-PSK without certificates?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [20 June 2022 07:33 UTC](https://discourse.nodered.org/t/using-tls-psk-with-mqtt/59872/9 "2022-06-20T07:33:13Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.