# coreMQTT Demo (Mutual Authentication) on Windows not work **URL:** \ **Category:** AWS\ **Created:** [June 5, 2024, 11:42am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617 "2024-06-05T11:42:57Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 5, 2024, 11:42am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/1 "2024-06-05T11:42:57Z")
I am trying to run the coreMQTT Demo (Mutual Authentication), following the configuration as described on [MQTT Demo (with TLS – Mutual Authentication) - FreeRTOS](https://freertos.org/mqtt/mutual-authentication-mqtt-example.html), but this demo is not running properly and the log is shown below. Can anyone suggest what can be the possible ways to fix this? ```auto The interface that will be opened is set by "configNETWORK_INTERFACE_TO_USE", which should be defined in FreeRTOSConfig.h Attempting to open interface number 2. Successfully opened interface number 2. 3 3415 [IP-Task] prvInitialiseDHCP: start after 250 ticks vDHCPProcess: discover 4 4674 [IP-Task] vDHCPProcess: offer 10.201.99.191 vDHCPProcess: reply 10.201.99.191 5 5134 [IP-Task] vDHCPProcess: offer 10.201.99.191 vDHCPProcess: acked 10.201.99.191 6 5134 [IP-Task] IP Address: 10.201.99.191 Subnet Mask: 255.255.0.0 7 5134 [IP-Task] Gateway Address: 10.201.0.1 DNS Server Address: 172.19.2.1 8 5415 [DemoTask] [INFO] [MqttMutualAuth] [prvConnectToServerWithBackoffRetries:735] Creating a TLS connection to a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com:8883. 9 10434 [DemoTask] FreeRTOS_ProcessDNSCache: add: 'a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com' @ 52.27.62.0 (TTL 60) DNS[0xD2ED]: The answer to 'a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com' (52.27.62.0) will be stored 10 10434 [DemoTask] [INFO] [SocketsWrapper] [TCP_Sockets_Connect:135] Creating TCP Connection to a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com. 11 10434 [DemoTask] FreeRTOS_connect: 2639 to 52.27.62.0:8883 Socket 2639 -> 52.27.62.0:8883 State eCLOSED->eCONNECT_SYN 12 10434 [IP-Task] prvSocketSetMSS: 1400 bytes for 52.27.62.0:8883 prvWinScaleFactor: uxRxWinSize 1 MSS 1400 Factor 0 13 10434 [IP-Task] Connect[52.27.62.0:8883]: next timeout 1: 3000 ms prvWinScaleFactor: uxRxWinSize 1 MSS 1400 Factor 0 14 13434 [IP-Task] Connect[52.27.62.0:8883]: next timeout 2: 6000 ms [ERROR] [SocketsWrapper] [TCP_Sockets_Connect:144] 15 15434 [DemoTask] Failed to connect to server: FreeRTOS_Connect failed: ReturnCode=-116, Hostname=a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com, Port=8883. 16 15434 [IP-Task] FreeRTOS_closesocket[2639 to 52.27.62.0:8883]: buffers 60 socks 0 [ERROR] [MbedtlsTransport] [TLS_FreeRTOS_Connect:678] 17 15434 [DemoTask] Failed to connect to a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com with error -116. 18 15434 [DemoTask] [WARN] [MqttMutualAuth] [prvConnectToServerWithBackoffRetries:760] Connection to the broker failed. Retrying connection with backoff and jitter. 19 15854 [DemoTask] [INFO] [MqttMutualAuth] [prvConnectToServerWithBackoffRetries:735] Creating a TLS connection to a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com:8883. ``` ---
**Author:** ![aggarg](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/aggarg/32/4245_2.png) [@aggarg](https://forums.freertos.org/u/aggarg)\ **Post date:** [June 6, 2024, 4:06am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/2 "2024-06-06T04:06:40Z")
> [@daofx123](#): > > `DNS[0xD2ED]: The answer to 'a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com' (52.27.62.0) will be stored` The DNS resolution seems to be working but the TCP connection cannot be established. Do you have a firewall that may be preventing this connection? Can you capture network traffic using wireshark? ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 4:14am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/3 "2024-06-06T04:14:56Z")
I have disabled the firewall on my computer, and then I took a screenshot while capturing packets with Wireshark, and I have also uploaded the packet capture file. ![微信图片_20240606121239](https://d2v6vdsk2p900z.cloudfront.net/original/2X/4/4569a874ec3120dd5dedb78415539573e50652b8.png) [log.zip](https://forums.freertos.org/uploads/short-url/qNlIframJi3CAuGkurwVSAv5V24.zip) (121.7 KB) ---
**Author:** ![aggarg](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/aggarg/32/4245_2.png) [@aggarg](https://forums.freertos.org/u/aggarg)\ **Post date:** [June 6, 2024, 4:32am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/4 "2024-06-06T04:32:42Z")
Thank you sharing network capture. As we can see, you do not get any SYNACK for the SYN you send. > [@daofx123](#): > > I have disabled the firewall on my computer It does not have to be a firewall on your computer but a firewall on your network. One possibility is that the firewall does not allow port 8883. You can try port 443 by making the following changes to demo\_config.h: ```auto #define democonfigUSE_AWS_IOT_CORE_BROKER ( 1 ) #define democonfigMQTT_BROKER_PORT ( 443 ) ``` ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 4:38am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/5 "2024-06-06T04:38:46Z")
I have tried this method, but I still have the same issue. The error message and the content captured by Wireshark are the same as before. ---
**Author:** ![aggarg](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/aggarg/32/4245_2.png) [@aggarg](https://forums.freertos.org/u/aggarg)\ **Post date:** [June 6, 2024, 4:54am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/6 "2024-06-06T04:54:56Z")
Can you try using [this TCP example](https://github.com/FreeRTOS/FreeRTOS/tree/main/FreeRTOS-Plus/Demo/FreeRTOS_Plus_TCP_Minimal_Windows_Simulator) to confirm if you area able to reach any server at all? ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 5:23am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/7 "2024-06-06T05:23:23Z")
OK, thanks. I have tried this example and made some configurations. My computer IP is 10.201.215.137. ```auto In main.c: #define mainCREATE_SIMPLE_UDP_CLIENT_SERVER_TASKS 0 #define mainCREATE_TCP_ECHO_TASKS_SINGLE 0 #define mainCREATE_TCP_ECHO_SERVER_TASK 1 In FreeRTOSConfig.h: #define configUDP_LOGGING_ADDR0 10 #define configUDP_LOGGING_ADDR1 201 #define configUDP_LOGGING_ADDR2 215 #define configUDP_LOGGING_ADDR3 137 #define configECHO_SERVER_ADDR0 10 #define configECHO_SERVER_ADDR1 201 #define configECHO_SERVER_ADDR2 215 #define configECHO_SERVER_ADDR3 137 In FreeRTOSIPConfig.h: #define ipconfigUSE_DHCP 1 ``` The output result: ![微信图片_20240606140102](https://d2v6vdsk2p900z.cloudfront.net/original/2X/0/07f1d9098b4f61537c9c5702c7cb85ac9c4c73a4.png) So I want to know if my configurations are correct and how to confirm if my area able to reach any server. ---
**Author:** ![tony-josi-aws](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tony-josi-aws](https://forums.freertos.org/u/tony-josi-aws)\ **Post date:** [June 6, 2024, 7:38am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/8 "2024-06-06T07:38:27Z")
@daofx123 How did you create the device IoT thing? Was it through AWS Command Line Interface (CLI) by running the `tools/aws_config_quick_start/SetupAWS.py` script. Did it succeed? Also can you check what is the security policy used in the AWS → IoT Core → Settings ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 7:51am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/9 "2024-06-06T07:51:59Z")
No, I use the AWS IoT console to create the device IoT thing. And the security policy used is TLS12\_1\_2\_2022\_10. ---
**Author:** ![tony-josi-aws](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tony-josi-aws](https://forums.freertos.org/u/tony-josi-aws)\ **Post date:** [June 6, 2024, 8:50am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/10 "2024-06-06T08:50:34Z")
@daofx123 Is the AWS IoT policy created as per these steps: [Create AWS IoT resources - AWS IoT Core](https://docs.aws.amazon.com/iot/latest/developerguide/create-iot-resources.html) Please make sure the created policy is attached to the thing and at least one version of the policy is active. [AWS IoT → Security → Policies → All versions] ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 9:06am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/11 "2024-06-06T09:06:30Z")
Yes, I created as those steps, and the policy is attched to the thing, one version of which is active. ![policy](https://d2v6vdsk2p900z.cloudfront.net/original/2X/a/a56e20ecc5a7d4799e29f50af5f6b5a440707207.png) ---
**Author:** ![tony-josi-aws](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tony-josi-aws](https://forums.freertos.org/u/tony-josi-aws)\ **Post date:** [June 6, 2024, 9:48am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/12 "2024-06-06T09:48:17Z")
Can you try creating the thing with the AWS Command Line Interface (CLI) by running the `tools/aws_config_quick_start/SetupAWS.py` script? ---
**Author:** ![tony-josi-aws](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tony-josi-aws](https://forums.freertos.org/u/tony-josi-aws)\ **Post date:** [June 6, 2024, 10:02am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/13 "2024-06-06T10:02:51Z")
Also, please make sure that your AWS IoT broker is reachable from your region. It seems to be reachable and connecting from where I’m trying: ```auto C:\Users\tonyjosi>ping a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com Pinging a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com [52.34.148.21] with 32 bytes of data: Reply from 52.34.148.21: bytes=32 time=240ms TTL=243 Reply from 52.34.148.21: bytes=32 time=241ms TTL=243 Reply from 52.34.148.21: bytes=32 time=240ms TTL=243 Reply from 52.34.148.21: bytes=32 time=240ms TTL=243 Ping statistics for 52.34.148.21: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 240ms, Maximum = 241ms, Average = 240ms C:\Users\tonyjosi>ncat a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com 8883 -v Ncat: Version 7.94 ( https://nmap.org/ncat ) Ncat: Connected to 52.34.148.21:8883. ``` ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 10:09am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/14 "2024-06-06T10:09:29Z")
yes, I can ping my AWS IoT broker from my region. And I am trying creating the thing with the AWS Command Line Interface (CLI). But what is the difference between this method and creating the thing by the AWS IoT console? ---
**Author:** ![tony-josi-aws](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tony-josi-aws](https://forums.freertos.org/u/tony-josi-aws)\ **Post date:** [June 6, 2024, 10:17am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/15 "2024-06-06T10:17:13Z")
The script does the same as what’s done through the console, except that its easier and the chances of missing/incorrect steps are lower. ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 10:36am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/16 "2024-06-06T10:36:10Z")
I also tried this method - creating the thing with AWS CLI, but the problem is the same. So what can I do to solve this question? ---
**Author:** ![tony-josi-aws](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tony-josi-aws](https://forums.freertos.org/u/tony-josi-aws)\ **Post date:** [June 6, 2024, 11:28am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/17 "2024-06-06T11:28:47Z")
Can you share the versions of FreeRTOS+TCP library and the demo code? ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 11:36am UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/18 "2024-06-06T11:36:45Z")
The version is FreeRTOS 202212.01. I ran the MQTT\_Mutual\_Auth demo, and I only changed the config file. And this is my demo code. [demo\_config.zip](https://forums.freertos.org/uploads/short-url/n7CG1gns9FySqHv8wyRZRU4yfJG.zip) (6.1 KB) ---
**Author:** ![aggarg](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/aggarg/32/4245_2.png) [@aggarg](https://forums.freertos.org/u/aggarg)\ **Post date:** [June 6, 2024, 12:40pm UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/19 "2024-06-06T12:40:51Z")
Thank you for sharing your demo\_config. Since it contains your private creds, I’d recommend to remove it and delete the cert from your AWS account later. Assuming you are using PowerShell, can you run the following command: ```auto Test-NetConnection -computername -port 8883 ``` Replace `` with your AWS IoT Broker endpoint. ---
**Author:** ![daofx123](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/daofx123/32/4671_2.png) [@daofx123](https://forums.freertos.org/u/daofx123)\ **Post date:** [June 6, 2024, 12:44pm UTC](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617/20 "2024-06-06T12:44:03Z")
Thanks for your recommendation, and this is the output: ```auto PS C:\Users\ASUS> Test-NetConnection -computername a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com -port 8883 ComputerName : a2vtd9m5hzbrcl-ats.iot.us-west-2.amazonaws.com RemoteAddress : 2620:108:700f::22d7:2366 RemotePort : 8883 InterfaceAlias : 以太网 SourceAddress : 2001:da8:1002:6001::3:4a2b TcpTestSucceeded : True ``` [Next page](https://forums.freertos.org/t/coremqtt-demo-mutual-authentication-on-windows-not-work/20617.md?page=2)