Constrained devices, MQTT, TLS

Yesterday evening I was doing some tests with an Arduino MKR1000 board.
It is a new board released some months ago. It is part of the Arduino family, but has some features specifically targeted to the IoT world.
It has WIFI on-board, has an encryption chip, and you can use MQTT.
Arduino has made available a Cloud Service (cloud.arduino.cc) where you can freely register your devices and test communication.

For example you can register several properties for each device (temperature, ...) and with an-easy-to-use API send updates.
The communication is based on MQTT over TLS.

Just a minute, I thought: but with TLS you need to encrypt the channel.
The usual handshake will happen: the broker has to send its certificate to the device and the certificate must be verified.
How is the board doing this?

The documentation is not complete, but walking around Internet and forums you find the answer
(thanks Google !).

The board contains a set of CA certificates, and for sure it is set up to recognize the site  

mqtt.arduino.cc

The problem arises when you try to use MQTT + TLS to connect to your gateway (RPI 3, in my case).
Here you not only need to set-up keys and certificates on the gateway, but also you need to upload the root CA on the MKR1000 board.

How can you do that?

Well, not easy. MKR1000 doesn't have a traditional file system and you cannot FTP files.
There is an utility. But it take some time to understand how to use it.
I'll try (probably) in the week-end.

Conclusion: a constrained device is less simple to set-up than a Linux based device.
Basically, this is one reason why they use Gateways. Your "things" communicate with a gateway locally and the gateway, on behalf, send messages to the IoT Cloud Service.

Stay tuned.