# MQTT broker

{% hint style="warning" %}
It is only possible to connect KPN Things to your MQTT broker using an **encrypted connection**! 
{% endhint %}

## Connect an MQTT broker

The following parameters are available to connect an MQTT broker:

| Parameter        |     | Description                                                                                                                                                                | Example value           |
| ---------------- | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |
| `name`           | \*  | The name of the destination                                                                                                                                                | *My Server*             |
| `description`    |     | Description of the destination                                                                                                                                             | *Endpoint of my server* |
| `host`           | \*  | The host name of the MQTT broker                                                                                                                                           | *broker.hivemq.com*     |
| `port`           | \*  | The port on which the MQTT broker allows encrypted connections                                                                                                             | *8883*                  |
| `username`       | \*† | The username for KPN Things to connect to the broker                                                                                                                       | your-username           |
| `password`       | \*† | The password for KPN Things to connect to the broker                                                                                                                       | your-password           |
| `applicationId`  | \*  | MQTT Client ID for KPN Things to connect to the broker                                                                                                                     | *kpnthings*             |
| `topic`          | \*  | The topic structure describing how KPN Things should publish data. There are several [variables](#variables) available                                                     | *things/%p/%d/%n*       |
| `qosLevel`       | \*  | <p>The MQTT Quality of Service desired for the connection to your broker.</p><p>Options:</p><ul><li>AT\_MOST\_ONCE</li><li>AT\_LEAST\_ONCE</li><li>EXACTLY\_ONCE</li></ul> | *AT\_LEAST\_ONCE*       |
| `messageTimeout` | \*  | Timeout for sending a message and handling QoS in milliseconds                                                                                                             | *10000*                 |
| `retainMessage`  | \*  | Whether messages send to the broker should be [retained messages](https://www.hivemq.com/blog/mqtt-essentials-part-8-retained-messages/).                                  | *false*                 |

*\*) required value*\
\&#xNAN;*†) secret value, can only be written*

## Variables&#x20;

<table><thead><tr><th width="260">Value</th><th>Replaced with</th></tr></thead><tbody><tr><td><code>%a</code></td><td>MQTT Client ID (<code>applicationId</code>)</td></tr><tr><td><code>%n</code></td><td><a href="../data-processing/thingsml-and-senml/senml">SenML</a> base name from the decoded payload</td></tr><tr><td><code>%c</code></td><td>Client UUID</td></tr><tr><td><code>%d</code></td><td>Device UUID</td></tr><tr><td><code>%p</code></td><td>Destination UUID</td></tr><tr><td><code>%m</code></td><td>Message request ID</td></tr><tr><td><code>%b</code></td><td>Device Barcode</td></tr></tbody></table>

## What does the connection do?

* Open an encrypted client connection to your MQTT broker.
* Publish all forwarded IoT data in [SenML](https://docs.kpnthings.com/kpn-things/building-blocks/data-processing/thingsml-and-senml/senml) JSON format on topics following the specified topic template.

## Trusted TLS/SSL certificates

We do not support self-signed certificates. Your TLS/SSL certificate should be signed by a root certificate authority (CA) that is trusted by the default Java trust store. You can use the [SSL Server Test from Qualys](https://www.ssllabs.com/ssltest/index.html) to check if your certificate is trusted by the Java trust store:

<figure><img src="https://1453626848-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl6RrePMSAjRvOgcHjMBZ%2Fuploads%2FVv0stdIlD6b759V4PilN%2Fimage.png?alt=media&#x26;token=58c92125-2284-4d83-aaa9-418d0bb13f90" alt=""><figcaption><p>he result of the SSL Server Test indicating the certificate is trusted by Java</p></figcaption></figure>

Your server should preferably use TLSv1.2 or higher, but at least TLSv1.1. Older protocols are not supported because they are not considered safe.&#x20;

## Learn about MQTT

Are you new to MQTT, but still interested in using it? HiveMQ has published some very nice articles about MQTT essentials:

{% embed url="<https://www.hivemq.com/mqtt-essentials/>" %}

## Test with a demo broker

For testing purposes, you can use the public MQTT broker available at <https://broker.hivemq.com>. When connecting to this broker, make sure to use **port 8883**. Although the broker supports anonymous access, you may enter any username and password in Things to establish the connection.

Keep in mind that this is an open, publicly accessible MQTT broker. **It is not suitable for production use.**

{% embed url="<https://broker.hivemq.com>" %}