Using ALPN Extensions with AWS IoT Core

AWS has announced in 2018 support for the ALPN TLS extension on its IoT Core service. We will see in this article what typical problems this update aims to solve, and implement a sample application making use of this extension to connect to AWS IoT using the AWS SDK for Node.js.

Picture from Alexandre Debiève on Unsplash

The ALPN Extension

ALPN (Application-Layer Protocol Negotiation) is an extension of the TLS protocol which allows applications (OSI layer 7) to negotiate, during the TLS handshake, which protocol should be performed over a secure connection in a manner that avoids additional round trips and which is independent of the application layer protocols.

The ALPN extension was standardized as part of the RFC7301 in July 2014, and describes well the typical use-case involving the addition of this extension in the TLS protocol:

When multiple application protocols are supported on a single server- side port number, such as port 443, the client and the server need to negotiate an application protocol for use with each connection. It is desirable to accomplish this negotiation without adding network round-trips between the client and the server, as each round-trip will degrade an end-user’s experience. Further, it would be advantageous to allow certificate selection based on the negotiated application protocol.

In a nutshell, this extension can be used by a server to differentiate between regular HTTP/TLS and MQTT/TLS connections using a different set of certificates in a way that is supported by the main TLS stacks.

Bypassing corporate firewalls

An increasing number of businesses, typically operating in fields such as the Industry 4.0 or on-site security monitoring, are deploying connected devices hosted on premises behind corporate firewalls. This has introduced a challenge where current firewalls port usage restrictions forbids access to ports commonly operated by different protocols in the field of the Internet of Things. In this article we’ll focus on how to bypass corporate firewalls by tunneling an MQTTS connection to AWS IoT on the port 443.

The ALPN extension introduced by AWS makes it possible to establish a connection to the AWS IoT MQTT broker using the TCP port 443 (MQTT/TLS originally uses the port 8883), taking advantage of the fact that this port is commonly open for outbound HTTPS traffic on the vast majority of firewalls.

A sample application

In the following example, we are going to use the AWS SDK (v1) for Node.js to establish an MQTTS connection to AWS IoT using the port 443. We will achieve this connection by providing an extra parameter, known as a ProtocolNameList, to the remote TLS server.

This parameter will contain a special protocol name recognized by AWS IoT : x-amzn-mqtt-ca. It will inform the remote TLS server that it should issue a CertificateRequest to the client over the TLS connection initiated by the AWS SDK. Subsequently, the thing certificate given to the SDK will be submitted to the server in order to complete the authentication.

In our implementation, we will first need to fill the special ALPNProtocols array, in the options passed to the AWS SDK, with the x-amzn-mqtt-ca custom protocol name. We will then add an additional port parameter specifying that we would like the SDK to open a connection on the port 443.

[embed]

At this stage, we are able to avoid a connection to the usual 8883 port by connecting directly to the port 443.

Using ALPN with Mosquitto

The mosquitto_pub command-line interface makes it easy to test an MQTT connection with a set of credentials. Similarly to the AWS SDK, mosquitto_pub introduced support for TLS ALPN protocols in 2018.

Below is an example of how to specify the appropriate TLS ALPN protocol required on the TLS connection to connect to AWS IoT Core when using port 443.

[embed]