ESP32通过MQTT连接Azure Event Grid失败（rc=-2）求助

问题描述 #

使用Arduino框架的ESP32尝试通过MQTT连接Azure Event Grid，连接持续失败，返回错误：

Failed, rc=-2 Retrying in 5 seconds...
Connecting to MQTT broker...

ESP32已正常接入Wi-Fi，且使用MQTTX客户端用同一客户端信息可成功连接，怀疑问题出在用户名或Client-ID配置上。

涉及代码 #

#include <WiFi.h>
#include <PubSubClient.h>
#include <ArduinoJson.h>
#include <WiFiClientSecure.h>

// Wi-Fi settings
const char* ssid = "T-HUB2.0";
const char* password = "Innovation";

// Azure Event Grid settings
const char* mqttBroker = "eventgrid1.southeastasia-1.ts.eventgrid.azure.net";
const int mqttPort = 8883;
const char* eventGridTopic = "Topics/topic1";
const char* username = "client1-authnID";
const char* deviceID = "client1-sessionID1";

// TLS/SSL client setup
WiFiClientSecure wifiClient;
PubSubClient mqttClient(wifiClient);

// Certificates
const char* caCert = "";

const char* clientCert = R"KEY(
-----BEGIN CERTIFICATE-----
MIIB7jCCAZSgAwIBAgIRAM86q1LIwWpvhSCeqIxrTmowCgYIKoZIzj0EAwIwRjEZ
MBcGA1UEChMQTXF0dEFwcFNhbXBsZXNDQTEpMCcGA1UEAxMgTXF0dEFwcFNhbXBs
ZXNDQSBJbnRlcm1lZGlhdGUgQ0EwHhcNMjMwNjE2MDYyNjMzWhcNMjMwOTI0MDYy
NjMwWjAaMRgwFgYDVQQDEw9jbGllbnQxLWF1dGhuSUQwWTATBgcqhkjOPQIBBggq
hkjOPQMBBwNCAASa8R2ZS4wE2c5GU6MApWM/u9F7/Qo1DRhS6VPsr2za0OTXuO9C
hOE3tpxu8G3/rsyM4bPj9I6DAZMebHXbbX/To4GOMIGLMA4GA1UdDwEB/wQEAwIH
gDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFKkhXgJe
Id1zDD5sESQi3ABs33WIMB8GA1UdIwQYMBaAFIeMEpJCsKRfq+HjhXmE0uVfubMP
MBoGA1UdEQQTMBGCD2NsaWVudDEtYXV0aG5JRDAKBggqhkjOPQQDAgNIADBFAiAq
sZYheFfVrlgNk6De060blPZkrim13yrJRmRo1WUMiAIhAPZ6R+5Hyl5sGB4m8HYh
9mHEl+qVZauee8HGu9IWyKYq
-----END CERTIFICATE-----
)KEY";

const char* clientKey = R"KEY(
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIAb/hcl7cXX8gHH8gjlhXjcaj8pTonHP+MzqcS2rHY13oAoGCCqGSM49
AwEHoUQDQgAEmvEdmUuMBNnORlOjAKVjP7vRe/0KNQ0YUulT7K9s2tDk17jvQoTh
N7acbvBt/67MjOGz4/SOgwGTHmx1221/0w==
-----END EC PRIVATE KEY-----
)KEY";

void setup() {
  Serial.begin(115200);
  delay(2000);

  // Connect to Wi-Fi
  WiFi.begin(ssid, password);
  while (WiFi.status() != WL_CONNECTED) {
    delay(1000);
    Serial.println("Connecting to WiFi...");
  }
  Serial.println("Connected to WiFi");

  // Load CA certificate, client certificate, and client key
  wifiClient.setCACert(caCert);
  wifiClient.setCertificate(clientCert);
  wifiClient.setPrivateKey(clientKey);

  // Set MQTT server and port
  mqttClient.setServer(mqttBroker, mqttPort);

  // Set MQTT callback function
  mqttClient.setCallback(callback);

  // Connect to MQTT broker
  connectToMqttBroker();
}

void loop() {
  if (!mqttClient.connected()) {
    // Reconnect to MQTT broker if the connection is lost
    connectToMqttBroker();
  }
  mqttClient.loop();

  // Publish message to Event Grid
  publishEvent();

  // Delay before publishing the next event
  delay(5000);
}

void connectToMqttBroker() {
  while (!mqttClient.connected()) {
    Serial.println("Connecting to MQTT broker...");

    if (mqttClient.connect(username, deviceID,"")) {
      Serial.println("Connected to MQTT broker");
    } else {
      Serial.print("Failed, rc=");
      Serial.print(mqttClient.state());
      Serial.println(" Retrying in 5 seconds...");
      delay(5000);
    }
  }
}

void callback(char* topic, byte* payload, unsigned int length) {
  // Handle incoming MQTT messages here if needed
}

void publishEvent() {
  // Create the event message
  DynamicJsonDocument eventMessage(256);
  eventMessage["id"] = "1";
  eventMessage["subject"] = "Example Event";
  eventMessage["eventType"] = "example.event";
  JsonObject eventData = eventMessage.createNestedObject("data");
  eventData["key"] = "value";

  // Serialize the event message to a JSON string
  String jsonMessage;
  serializeJson(eventMessage, jsonMessage);

  // Publish the event message to Event Grid
  mqttClient.publish(eventGridTopic, jsonMessage.c_str());
}

解决方法 #

1. 修正MQTT连接参数顺序 #

PubSubClient的connect方法参数顺序为Client ID在前，用户名在后，当前代码参数顺序颠倒，导致身份验证失败。
修改connectToMqttBroker函数中的连接代码：
原代码：

if (mqttClient.connect(username, deviceID,"")) {

修改为：

if (mqttClient.connect(deviceID, username, "")) {

2. 补充CA证书 #

当前代码中caCert为空，ESP32无法验证Azure服务器证书，会导致TLS握手失败（rc=-2通常对应TLS连接错误）。添加Azure认可的根CA证书（如DigiCert Global Root CA）：

const char* caCert = R"KEY(
-----BEGIN CERTIFICATE-----
MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
-----END CERTIFICATE-----
)KEY";

3. 验证Topic权限与格式 #

确认Azure Event Grid中Topics/topic1已创建，且当前客户端拥有该Topic的发布权限。

4. 开启TLS调试（可选） #

若问题仍存在，开启WiFiClientSecure的调试日志，查看TLS握手细节：
在wifiClient.setCACert(caCert);之后添加：

wifiClient.setDebugLevel(SSL_DEBUG_ALL);

通过Serial Monitor查看详细日志，进一步定位问题。

内容的提问来源于stack exchange，提问作者Niescte