How do I set up TLS on a mosquitto (MQTT) broker?

Question

I got mosquitto working, using plain old TCP but i want to secure it using SSL and TLS, so i followed the following guide to create the certificates for my mosquitto broker:

https://mosquitto.org/man/mosquitto-tls-7.html

Then I added the following lines to the config file:

listener 8883
cafile /mqtt/certs/ca.crt
certfile /mqtt/certs/server.crt
keyfile /mqtt/certs/server.key
require_certificate false

But now when i try to use mosquitto_sub on another machine to try to connect to the mosquitto broker over port 8883 (TLS), i get the following error on the broker

New connection from XX.XXX.XXX.XXX on port 8883.
OpenSSL Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
OpenSSL Error: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure
Socket error on client <unknown>, disconnecting.

I've tried doing the mosquitto_sub the following ways:

$ mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883
$ mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883 --cafile ca.crt
$ mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883 --cafile ca.crt --cert client.crt --key client.key

And the certificates on the client side were generated based on the first link i mentioned earlier.

Anyone know why this is happening and how I can go about fixing it?

Answer 1

This is the good way to subscribe as you do not require client certificate :

 mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883 --cafile ca.crt

It seems that the client fail to verify the server certificate. You should make sure that :

• ca.crt is the same on client and server side
• the common name of your server certificate corresponds to its hostname

Also check if you have the same openssl version on server and client side as this error could also happen if client and server do not use a common protocol or do not share any cypher

hope it could help, else I will be interested to know how you solved this problem

Answer 2

尝试--insecure选项。

mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883 --cafile ca.crt --insecure