Automating MQTT Engine/Transmission mTLS Setup

Ignition
1

Hi,

I’m trying to confirm if there is a supported way to automate mTLS configuration for Cirrus Link MQTT Engine/Transmission in Ignition? My goal is to automate certificate provisioning and MQTT server setup from a deployment script instead of manually uploading/configuring everything through the UI.

When I upload a CA cert, client cert, or private key through the MQTT Engine UI for example, Ignition creates config files under:

data/config/resources/core/com.cirruslink.mqtt.engine.gateway/cert-file/

The config files contains the encrypted structure generated by the Secrets Management system (ciphertext, encrypted_key, iv, protected, tag, etc).

Questions

  1. Is there a supported API to create MQTT certificate resources? I didn't see any MQTT Engine/Transmission cert endpoints in /openapi documentation and wanted to confirm if these resources are available elsewhere.

  2. Can the Secrets Management encryption API (system.secrets.encrypt) be used to generate the encrypted JSON for certificate and server resources? I'm unsure if the MQTT module will recognize resources created this way.

  3. And is directly writing resource files under data/config/resources/... supported? If I generate the encrypted JSON myself and placed it in the correct folder structure, will the Gateway and the engine/transmission register it?

Any clarification or insights are appreciated.

Thanks

2

Did you figure out how to solve this? I am trying to figure out a solution as well :thinking:

3

Creating secrets via system.secrets or the web API should yield something you can seed in the right place on disk. If you do this before the Ignition Gateway starts, it will get picked up when it starts. If you do it while running, you'll need to hit the route that requests a config scan.

4

I understand those are the constraints. I have some solutions I will be trying out.

5

The solution I ended up implementing was to use Ignition's Secrets Management system with referenced secrets instead of uploading certificate files directly or using the web API.

Rather than trying to recreate the encrypted resource format generated by Secrets Management (ciphertext, encrypted_key, iv, protected, tag, etc.), I stored the certificates in a Secrets Provider and configured the MQTT certificate resources to reference those secrets.

The certificate resource uses a structure like this:

"data": {
      "providerName": "provider-name",
      "secretName": "cert-secret-name"
    },
    "type": "Referenced"

By using referenced secrets, I don't have to generate or manage the encrypted JSON format. The MQTT Engine/Transmission modules resolve the certificate through the configured Secrets Provider, which was much easier to automate.